CVE-2026-75921
Received Received - Intake

Arbitrary File Upload in Master Addons for Elementor WordPress Plugin

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Wordfence

Description
The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.9 via the upload_template_kit function. This is due to incorrect authorization on the upload_template_kit() AJAX handler, which requires only upload_files capability instead of the manage_options required by all sibling handlers, combined with missing per-entry file type filtering after ZIP extraction. This makes it possible for authenticated attackers, with editor-level access and above, to upload files that may be executable, which makes remote code execution possible. Editors can satisfy the nonce requirement because the required nonces are localized on the standard Pages list screen, which is accessible to any user with the edit_pages capability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-75921
EUVD
EUVD-2026-68968

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
master_addons elementor_addons to 3.1.9 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Arbitrary File Upload flaw in the Master Addons for Elementor WordPress plugin. It allows authenticated attackers with editor-level access or higher to upload executable files via a flawed AJAX handler. The issue stems from weak authorization checks and missing file type filtering after ZIP extraction.

Detection Guidance

Check for unauthorized file uploads in WordPress directories, especially in template kits or uploads folders. Review server logs for POST requests to /wp-admin/admin-ajax.php with action=upload_template_kit. Use commands like grep -r 'upload_template_kit' /var/log/ or find /wp-content -type f -name '*.php' -newer /tmp/ to detect suspicious activity.

Impact Analysis

Attackers could exploit this to upload malicious files to your WordPress site, potentially leading to remote code execution. This could allow them to take control of your website, steal data, or install backdoors for further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. Organizations may face legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Update the Master Addons plugin to the latest version (3.1.9 or higher). Remove editor-level access for users unless absolutely necessary. Implement stricter file upload restrictions by adding file type checks and validating ZIP contents. Monitor for unusual file uploads or executions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75921. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart