CVE-2026-75921: Master Addons for Elementor <= 3.1.9 - Incorrect Authorization to Authenticated (Editor+) Arbitrary File Upload via upload_template_kit AJAX ZIP Extraction

Q: Which users can exploit this issue?

Any authenticated WordPress user with editor-level access or higher can exploit it. The affected AJAX handler requires the upload_files capability, and editors can obtain the required nonce from the standard Pages list screen because they have edit_pages capability.

Q: Does exploitation require an administrator account or user interaction?

No administrator account is required; editor-level access is sufficient. Exploitation does not require victim interaction, but the attacker must already be authenticated.

Q: What is the practical impact of a successful exploit?

An attacker can upload a ZIP archive whose extracted contents include files that may be executable. This can make remote code execution possible, with potential confidentiality, integrity, and availability impact.

Q: Which installations are affected?

All versions of the plugin up to and including 3.1.9 are affected. The issue is in the upload_template_kit AJAX handler used for template-kit ZIP extraction.

Published Sep 1, 2026

Updated

The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.9 via the uploadtemplatekit function. This is due to incorrect authorization on the uploadtemplatekit() AJAX handler, which requires only uploadfiles capability instead of the manageoptions required by all sibling handlers, combined with missing per-entry file type filtering after ZIP extraction. This makes it possible for authenticated attackers, with editor-level access and above, to upload files that may be executable, which makes remote code execution possible. Editors can satisfy the nonce requirement because the required nonces are localized on the standard Pages list screen, which is accessible to any user with the editpages capability.

Affected Software

1 affected component

WordPress Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits<=3.1.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress plugin: Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits to a version that resolves this vulnerability.
Fixed in 3.1.9

Event History

Sep 1, 2026

CVE Published

via MITRE·04:27 AM

Data Sourced

via MITRE·04:27 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

Any authenticated WordPress user with editor-level access or higher can exploit it. The affected AJAX handler requires the upload_files capability, and editors can obtain the required nonce from the standard Pages list screen because they have edit_pages capability.

Does exploitation require an administrator account or user interaction?

No administrator account is required; editor-level access is sufficient. Exploitation does not require victim interaction, but the attacker must already be authenticated.

What is the practical impact of a successful exploit?

An attacker can upload a ZIP archive whose extracted contents include files that may be executable. This can make remote code execution possible, with potential confidentiality, integrity, and availability impact.

Which installations are affected?

All versions of the plugin up to and including 3.1.9 are affected. The issue is in the upload_template_kit AJAX handler used for template-kit ZIP extraction.

CVE-2026-75921: Master Addons for Elementor <= 3.1.9 - Incorrect Authorization to Authenticated (Editor+) Arbitrary File Upload via upload_template_kit AJAX ZIP Extraction

Affected Software

Remediation

Event History

Frequently Asked Questions

Which users can exploit this issue?

Does exploitation require an administrator account or user interaction?

What is the practical impact of a successful exploit?

Which installations are affected?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

Does exploitation require an administrator account or user interaction?

What is the practical impact of a successful exploit?

Which installations are affected?