CVE-2026-75921

Master Addons for Elementor, a WordPress plugin, is vulnerable to authenticated arbitrary file upload in all versions up to and including 3.1.9 via the upload_template_kit() AJAX handler. The handler enforces the upload_files capability instead of the manage_options capability required by its sibling handlers, performs no per-entry file type validation after extracting a template-kit ZIP, and can be triggered by editors because the required nonces are localized on the Pages list screen, which is accessible to any user with edit_pages. An attacker with editor-level or higher access can therefore upload executable files, enabling remote code execution on the affected site. Any WordPress installation running the plugin at version 3.1.9 or earlier is affected, with risk concentrated on sites where editor-or-higher accounts are compromised or misused. No public proof-of-concept or confirmed in-the-wild exploitation is known; EPSS currently estimates a 0.6% chance of exploitation within the next 30 days.

What to do: Upgrade Master Addons for Elementor to the latest patched release (any version beyond 3.1.9) as soon as it is available. Until upgraded, audit and minimize editor-level accounts and scan the uploads directory for unexpected executable files (e.g., PHP); a WAF/virtual-patching rule (e.g., Wordfence) can block exploitation in the interim.