Master Addons for Elementor CVE-2026-85410

Exploitation requires an authenticated account with Contributor-level capabilities or above on a WordPress site running Master Addons for Elementor version 3.2.2 or earlier. The attacker must retrieve the nonce emitted on the edit-jltma_popup admin screen - accessible to Contributors precisely because the jltma_popup custom post type is registered with capability_type='post' - then supply an attacker-controlled popup_id to reach arbitrary posts. No end-user interaction is needed (UI:N). The practical limiting factor is the need for a low-privilege account, so sites that allow open/self-service registration or host multiple untrusted authors are most exposed; single-admin sites with no untrusted low-privilege users are effectively not exploitable.

This is a genuine priority for sites running the affected plugin, but not a mass-exploitation panic. The CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) is well-supported by the description: a network-reachable, low-complexity flaw requiring only Contributor-level authentication (PR:L) that permits permanent deletion (A:H) and metadata/title tampering (I:H) of ARBITRARY posts, with no confidentiality impact (C:N) - consistent with an authorization/IDOR class bug, not data theft. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis'; the absence of these signals means risk is currently potential rather than demonstrated in the wild. The single most important limiting factor is the PR:L authentication requirement - the attacker must already hold a Contributor (or higher) account, which is common on multi-author/membership blogs but not on locked-down single-admin sites. Conflict to note: the input Tag 'Authentication Bypass' contradicts the actual mechanism (CWE-862 missing authorization by an ALREADY-authenticated Contributor); this is a labeling error, not an unauthenticated bypass. Overall: treat as high-severity where untrusted Contributor accounts exist; lower practical urgency on sites with no low-privilege users.

An attacker who registers or obtains a Contributor account on a WordPress site running Master Addons for Elementor <=3.2.2 loads the edit-jltma_popup admin screen (reachable to Contributors because the jltma_popup CPT uses capability_type='post') to harvest the required nonce, then submits requests supplying an attacker-controlled popup_id pointing at posts they do not own. Because the plugin verifies the nonce but not object-level authorization, the attacker can rewrite titles/metadata of arbitrary posts or permanently delete them site-wide. No public exploit code is identified at time of analysis, but the vulnerable code lines are publicly referenced in the plugin's trac browser.