Master Addons lets public visitors disable Popup Builder popups
Master Addons for Elementor from 3.0.0 up to but not including 3.1.9, the AJAX action that deactivates Popup Builder popups checks only a nonce that is exposed to every visitor. Without a capability check, an unauthenticated attacker can use that nonce to permanently disable any popup. The export does not name the AJAX action, popup-ID field or handler.
- Component
- Master Addons for Elementor
- Plugin slug
master-addons- Affected
- 3.0.0 to < 3.1.9
- Safe version
3.1.9- Published
- Sep 17, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Sep 17, 2026 and is one of 29 known issues for this plugin.
Update, patch or deactivate.
Update Master Addons for Elementor to 3.1.9 or later. Require popup-management permission and validate an action-bound nonce before changing a popup's state. Treat publicly available nonces as request tokens, not authorization, and review unexpectedly disabled popups.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup on the site.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N