Security Alert Summary
The Master Addons for Elementor plugin contains an authorization issue in an AJAX action that deactivates Popup Builder popups. The plugin relied on a nonce that was publicly output to visitors instead of performing a proper authorization check, allowing unauthenticated attackers to permanently disable popups on affected sites.
CVE Details
- CVE ID: CVE-2026-91015
- Affected component: Master Addons for Elementor WordPress plugin
- Affected versions: Versions before 3.1.9 (examples include 3.0.0 listed as affected)
- Published: September 17, 2026 at 6:16:53 AM
- Last modified: September 17, 2026 at 1:16:59 PM
- CVSS v3.1: Base score 5.3, MEDIUM; Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Authentication / privileges / user interaction: No authentication required; privileges required: NONE; user interaction: NONE
- Primary impact: Confidentiality: NONE; Integrity: LOW (popups can be disabled); Availability: NONE
- CWE / weakness ID: CWE-862
Technical Details
The vulnerability exists because the plugin does not perform an authorization check on the AJAX action that deactivates Popup Builder popups. Instead, it relied solely on a nonce that the plugin publicly outputs to every visitor. Because the nonce is exposed to unauthenticated visitors, attackers can invoke the AJAX action and cause popups to be deactivated permanently.
The description references the plugin’s Popup Builder deactivation AJAX action and the publicly output nonce. No specific function names or REST endpoints beyond this AJAX action are provided in the available data.
Impact is limited to the integrity of popups on the site: an attacker able to trigger the action can disable popups, removing any content, forms, or notices delivered via those popups. The vulnerability does not indicate direct data disclosure or availability impact beyond popup removal.
How This Could Impact Your Website
Consider a site with multiple users: a site owner, internal staff who manage content and marketing, and an external contractor or contributor who helps with design. If popups are used for forms, marketing banners, subscription prompts, verification steps, or security notifications, an attacker could disable those popups without authenticating.
- Marketing or conversion popups could be removed, reducing lead capture and disrupting workflows used by internal staff and contractors.
- If popups were used to surface contact details or internal workflows, their removal could interfere with how email addresses and contacts are presented or collected. While this vulnerability does not directly disclose user data (confidentiality impact: none), removing popups that provide verification or instructions can indirectly increase the risk of targeted phishing or social engineering.
- Site owners and administrators may need to coordinate with staff or external contractors to restore popup configuration and verify that no additional misuse occurred.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and any accounts with the ability to trigger plugin actions.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and logs for unusual behavior related to AJAX calls or popup configuration changes.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
