CVE-2026-91015: Master Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_disable_expired
The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup on the site.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/Master Addons for Elementorto a version that resolves this vulnerability.Fixed in 3.1.9 - Compensating control
Restrict public access to the WordPress admin and reduce exposure of the plugin’s unauthenticated AJAX action that deactivates Popup Builder popups (the endpoint relies only on a publicly output nonce prior to 3.1.9).
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using Master Addons for Elementor versions earlier than 3.1.9 are affected if they use Popup Builder popups. The vulnerable AJAX nonce is publicly output to every visitor, so exposure does not depend on an attacker having a WordPress account.
What does an attacker need to do to exploit it?
An attacker needs access to the publicly available nonce and must invoke the jltma_popup_disable_expired AJAX action. No authentication is required.
What is the impact of successful exploitation?
An unauthenticated attacker can permanently disable any Popup Builder popup on the affected site.