CVE-2026-91015 — Master Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_disable_expired

CVE-2026-91015

Master Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_disable_expired PUBLISHED

Description (CNA)

The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup on the site.

Affected (CNA)

Vendor / product	Versions
Unknown / Master Addons for Elementor	affected 3.0.0 before 3.1.9

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/e052c684-7b82-4555-8bf7-600b894264db/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.