CVE-2026-91015

The Master Addons for Elementor WordPress plugin before 3.1.9 lacks a proper authorization check on the AJAX action jltma_popup_disable_expired, which deactivates its Popup Builder popups. The only safeguard is a nonce that is publicly output to every visitor, making it accessible to unauthentica...

CVE-2026-91015 Master Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_disable_expired

The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup...