CVE-2026-91015 Master Addons CVE debrief

Who should care

Defenders responsible for WordPress sites using the Master Addons for Elementor plugin should assess exposure and prioritize updating the plugin to 3.1.9 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify the plugin version and ensure it is up-to-date to prevent exploitation. Additionally, defenders should review compensating controls for exposed systems and monitor for signs of

Why it matters

The Master Addons for Elementor WordPress plugin vulnerability allows unauthenticated attackers to permanently disable any popup on the site, requiring defenders to verify the plugin version and update to 3.1.9 or later.

• Unauthenticated attackers can permanently disable any popup on the site
• Defenders need to verify the version of the Master Addons for Elementor plugin
• Updating the plugin to 3.1.9 or later can prevent exploitation

Technical summary

The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor. This allows unauthenticated attackers to permanently disable any popup on the site. The vulnerability is due to a lack of proper authorization checks, which enables attackers to exploit the plugin's functionality without proper validation. Defenders should prioritize verifying the version of the Master Addons for Elementor plugin and ensuring it is updated to 3.1.9 or later to prevent unauthorized deactivation of popups.

Defensive priority

Defenders should prioritize verifying the version of the Master Addons for Elementor plugin and ensuring it is updated to 3.1.9 or later to prevent unauthorized deactivation of popups.

Recommended defensive actions

• Verify the version of the Master Addons for Elementor plugin and update to 3.1.9 or later
• Monitor for unauthorized deactivation of popups
• Implement additional security measures to prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score. However, additional information from other sources may be necessary to fully assess the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.