CVE-2026-85410 pixarlabs CVE debrief

Who should care

Defenders managing WordPress environments with the Master Addons for Elementor plugin should assess exposure and prioritize updates and compensating controls. This includes reviewing current plugin versions, assessing the risk of post modifications and deletions by contributors, and implementing measures to restrict these actions. Security teams and platform administrators should verify and update the plugin, monitor for suspicious activity, and adjust as-

Why it matters

CVE-2026-85410 is a high-severity authorization bypass vulnerability in the Master Addons for Elementor plugin for WordPress. Defenders managing WordPress environments with this plugin should assess exposure, prioritize updates, and implement compensating controls to restrict post modifications and deletions by contributors.

• Authenticated attackers with contributor-level access can modify arbitrary post titles and metadata.
• Authenticated attackers can permanently delete arbitrary WordPress posts.
• Defenders need to verify and update the plugin to prevent exploitation.
• Exposure requires verification from official sources.

Technical summary

The Master Addons for Elementor plugin for WordPress is vulnerable to authorization bypass due to improper verification of user authorization. This allows authenticated attackers with contributor-level access to modify titles and metadata of arbitrary WordPress posts or permanently delete posts by supplying an attacker-controlled popup_id. The required nonce is emitted on the edit-jltma_popup admin screen, which is accessible to Contributors because the jltma_popup custom post type is registered with capability_type='post'.

Defensive priority

Defenders should prioritize verifying and updating the Master Addons for Elementor plugin, assessing exposure in their environments, and implementing compensating controls to restrict post modifications and deletions.

Recommended defensive actions

• Verify and update the Master Addons for Elementor plugin to the latest version.
• Assess exposure in environments and restrict post modifications and deletions.
• Implement compensating controls to monitor and limit actions by contributors.
• Review and adjust access controls for the edit-jltma_popup admin screen.
• Monitor for suspicious post modifications and deletions.
• Conduct regular security audits of WordPress environments.
• Track changes to the Master Addons for Elementor plugin for future updates.

Evidence notes

The vulnerability is due to improper authorization checks in the plugin. The required nonce is emitted on the edit-jltma_popup admin screen, accessible to Contributors. This allows attackers to modify or delete posts by supplying an attacker-controlled popup_id.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.