CVE-2026-62089
HighCVSS 7.1Summary
The Master Addons for Elementor plugin by Pixar Labs in versions up to and including 3.2.2 contains a missing authorization vulnerability allowing privilege abuse. An unauthorized user can perform operations they should not have access to.
Risk Assessment
The lack of authorization checks allows an attacker to perform actions with higher privileges than intended, potentially leading to site configuration changes. This can result in takeover of the WordPress site.
Recommendation
Update the Master Addons for Elementor plugin to a version newer than 3.2.2. Check the site for signs of unauthorized modifications.
Other vulnerabilities in Master Addons for Elementor
See all- CVE-2026-75921High
The Master Addons for Elementor plugin for WordPress up to version 3.1.9 is vulnerable to arbitrary file upload via the upload_template_kit function. This is due to incorrect authorization on the AJAX handler, which requires only upload_files capability instead of manage_options, combined with missing file type filtering after ZIP extraction. This allows authenticated attackers with editor-level access and above to upload executable files, leading to remote code execution.
- CVE-2026-9281Medium
The Master Addons For Elementor plugin for WordPress up to version 3.1.0 is vulnerable to Stored Cross-Site Scripting via the 'jtlma_custom_js' Page Setting due to insufficient input sanitization and output escaping.
Original NVD description (English source)
Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for Elementor: from n/a through 3.2.2.