EUVD-2026-68968
GHSA-xf8m-6j3r-c89p
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Editor is a default WordPress content role holding upload_files by default, making PR:L more accurate than PR:H; no special conditions needed reduces AC to L.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Master Addons for Elementor - Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.9 via the upload_template_kit function. This is due to incorrect authorization on the upload_template_kit() AJAX handler, which requires only upload_files capability instead of the manage_options required by all sibling handlers, combined with missing per-entry file type filtering after ZIP extraction. This makes it possible for authenticated attackers, with editor-level access and above, to upload files that may be executable, which makes remote code execution possible. Editors can satisfy the nonce requirement because the required nonces are localized on the standard Pages list screen, which is accessible to any user with the edit_pages capability.
AnalysisAI
Arbitrary file upload in Master Addons for Elementor (all versions through 3.1.9) enables WordPress users with editor-level access to achieve remote code execution by exploiting a misconfigured AJAX authorization check. The upload_template_kit() handler incorrectly enforces only the upload_files capability-held by editors by default-rather than the manage_options capability required by every sibling handler, and performs no file-type filtering on content extracted from uploaded ZIP archives, allowing PHP webshells and other executable files to land on the server. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress account with the editor role or higher, specifically one that holds both the upload_files and edit_pages capabilities-both are granted to editors by default in standard WordPress installations. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H scores 7.2 and uses PR:H (high privilege). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Site administrators should immediately update the Master Addons for Elementor plugin to the latest version available in the WordPress plugin directory; a fix is confirmed in SVN changeset 3666783 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3666783%40master-addons&new=3666783%40master-addons), though the specific patched release version number is not independently confirmed in the available data-verify that the installed version is newer than 3.1.9 post-update. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations using Master Addons for Elementor through version 3.1.9 and identify which have active editor-level users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today