CVE-2026-85410

Name of the Vulnerable Software and Affected Versions Master Addons for Elementor versions prior to 3.2.3

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with contributor-level access or higher can modify the title and metadata of arbitrary WordPress posts or permanently delete them. This is achieved by providing a controlled popup id variable. The necessary nonce is available on the edit-jltma popup admin screen, which is accessible to contributors because the jltma popup custom post type is registered with capability type='post'.

Recommendations Update the plugin to a version newer than 3.2.2.