CVE-2026-91015: Master Addons Elementor Auth Bypass

CVE-2026-91015 Overview

CVE-2026-91015 is a missing authorization vulnerability [CWE-862] in the Master Addons for Elementor WordPress plugin before version 3.1.9. The plugin exposes an AJAX action that deactivates Popup Builder popups without verifying user capabilities. The endpoint relies solely on a nonce that the plugin publicly outputs to every site visitor. Unauthenticated attackers can retrieve the nonce and invoke the AJAX action to permanently disable any popup on the site.

Critical Impact
Unauthenticated remote attackers can permanently disable Popup Builder popups on any affected WordPress site, degrading marketing, lead generation, and site announcement functionality.

Affected Products

Master Addons for Elementor WordPress plugin versions prior to 3.1.9

Discovery Timeline

2026-09-17 - CVE-2026-91015 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91015

Vulnerability Analysis

The vulnerability resides in the AJAX handler responsible for deactivating Popup Builder popups within the Master Addons for Elementor plugin. The handler validates a nonce but omits a capability or role check on the requesting user. Because the nonce is rendered into markup served to every visitor, including unauthenticated ones, the nonce provides no meaningful access control. An attacker can parse the nonce from any public page and submit an AJAX request that toggles a popup's status to inactive. The change persists in the database, so restoring the popup requires administrative intervention.

Root Cause

The root cause is a missing authorization check [CWE-862]. The plugin conflates nonce verification with authorization, a common WordPress anti-pattern. Nonces are designed to prevent Cross-Site Request Forgery, not to enforce access control. Because the nonce is exposed to unauthenticated visitors, no privilege boundary protects the deactivation action.

Attack Vector

Attack traffic originates from the network and requires no authentication or user interaction. The attacker fetches a public page of the target WordPress site to extract the nonce, then issues an HTTP POST request to /wp-admin/admin-ajax.php with the vulnerable action parameter, the popup identifier, and the harvested nonce. The server processes the request and marks the popup as deactivated. See the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-91015

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php referencing the popup deactivation action from unauthenticated sessions.
Popup Builder popups appearing as deactivated in the WordPress admin without a corresponding administrator action in the audit log.
Requests originating from anonymous IP ranges targeting admin-ajax.php at unusually high frequency.

Detection Strategies

Enable web server access logging and search for POST requests to admin-ajax.php that carry the Master Addons popup deactivation action name.
Correlate WordPress audit log entries for popup status changes with authenticated administrator sessions to identify unauthenticated modifications.
Deploy a Web Application Firewall rule that inspects admin-ajax.php requests and blocks the vulnerable action from unauthenticated clients.

Monitoring Recommendations

Alert on popup configuration changes that occur outside expected administrator workflows.
Monitor plugin file integrity and plugin version to confirm patched code is in place across all WordPress instances.
Track AJAX endpoint request rates to identify enumeration or abuse patterns.

How to Mitigate CVE-2026-91015

Immediate Actions Required

Update the Master Addons for Elementor plugin to version 3.1.9 or later on every affected WordPress site.
Audit Popup Builder popup states after patching and re-enable any popups that were deactivated without authorization.
Review web server and WordPress logs for evidence of prior exploitation attempts against admin-ajax.php.

Patch Information

The vendor addressed the issue in Master Addons for Elementor version 3.1.9 by adding a capability check to the popup deactivation AJAX handler. Refer to the WPScan Vulnerability Report for the advisory reference.

Workarounds

Deactivate the Master Addons for Elementor plugin until the site can be updated to version 3.1.9.
Restrict access to /wp-admin/admin-ajax.php at the WAF or reverse proxy layer, blocking the vulnerable action name from unauthenticated sources.
Enforce IP allowlisting for administrative endpoints where operationally feasible.

bash

# Configuration example: WAF rule concept to block the vulnerable AJAX action
# Block unauthenticated POST requests to admin-ajax.php that invoke the popup deactivation action
# Adapt the action name to match the vendor's parameter after reviewing the plugin source
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:2026091015,msg:'Block Master Addons popup deactivation abuse'"
  SecRule ARGS:action "@rx (?i)master_addons.*deactivate.*popup" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"