CVE-2026-91015

Name of the Vulnerable Software and Affected Versions Master Addons for Elementor versions prior to 3.1.9

Description The plugin fails to perform an authorization check on the AJAX action used to deactivate Popup Builder popups. It relies solely on a nonce (a number used once to prevent replay attacks) that is publicly exposed to all visitors. This allows unauthenticated attackers to permanently disable any popup on the site via the jltma popup disable expired action.

Recommendations Update to version 3.1.9 or later.