Master Addons for Elementor CVE-2026-9281

Exploitation requires the attacker to hold an authenticated WordPress session at author level or higher (PR:L per CVSS vector) - unauthenticated exploitation is not possible. The Master Addons for Elementor plugin must be installed and active, and specifically the Custom JS Extension (jtlma_custom_js Page Setting) feature must be available and not administratively disabled. The attack path requires direct HTTP POST access to admin-ajax.php?action=elementor_ajax, which is standard on any WordPress installation with the plugin active and not blocked by a WAF or firewall rule. Exploitation is limited by the requirement for valid author-level credentials, which confines the realistic threat surface to: multi-author sites with untrusted contributors, sites with weak credential hygiene, or sites permitting open author-level registration. Sites where all author-level and above accounts are held by trusted parties face significantly reduced practical risk despite the network-accessible attack vector.

The CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) score reflects moderate severity with some important nuances. Attack vector is network and complexity is low, meaning exploitation requires no special network position or unusual conditions once the attacker is authenticated. The PR:L designation confirms author-level credentials are required - this is not an unauthenticated vector. The changed scope (S:C) elevates the score because the injected payload executes in victims' browsers, potentially enabling session hijacking, credential theft, or further payload delivery against site visitors, including privileged administrators. EPSS data was not provided in the source intelligence, so exploitation probability cannot be quantified numerically. KEV status is not listed, and no public POC was identified at time of analysis. Real-world risk is moderate-to-elevated for multi-author WordPress sites (agencies, content platforms, membership sites) where untrusted author-level users exist; sites with tightly controlled authorship are at lower practical risk. The bypass technique (direct AJAX POST bypassing UI checks) is straightforward and repeatable, lowering the effective complexity for a motivated attacker already holding author credentials.

An attacker who has obtained author-level credentials on a target WordPress site - through credential stuffing, phishing, or account registration if author self-registration is enabled - crafts a POST request directly to admin-ajax.php?action=elementor_ajax, embedding a malicious payload in the jtlma_custom_js parameter without triggering the UI-level unfiltered_html capability check. The injected script is saved to the page and executes silently in every subsequent visitor's browser, including logged-in administrators, enabling session cookie theft or drive-by payload delivery. No public POC has been identified at time of analysis, but the bypass technique is straightforwardly derivable from the source code references in the disclosure.