CVE-2026-85410: Master Addons for Elementor <= 3.2.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification/Deletion via 'popup_id' Parameter
The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify the title and metadata of arbitrary WordPress posts or permanently delete arbitrary WordPress posts by supplying an attacker-controlled popupid. The required nonce is emitted on the edit-jltmapopup admin screen, which is accessible to Contributors because the jltmapopup custom post type is registered with capabilitytype='post'.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Master Addons for Elementor (Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits)to a version that resolves this vulnerability.Fixed in 3.2.2 - Compensating control
Restrict access to the WordPress admin screen that exposes the required nonce on the edit-jltma_popup admin screen so that only users with appropriate authorization (beyond Contributor) can access it.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to WordPress with Contributor-level access or higher. They do not need victim interaction, and the attack can be performed remotely.
Does exploitation require access to the plugin's popup editing interface?
The required nonce is emitted on the edit-jltma_popup admin screen. Contributors can access that screen because the jltma_popup custom post type uses capability_type='post'.
What can a successful attacker change or delete?
A successful attacker can modify the title and metadata of arbitrary WordPress posts. They can also permanently delete arbitrary WordPress posts by controlling the popup_id parameter.
Which plugin versions are affected?
All versions up to and including 3.2.2 are affected.