Is CVE-2026-91015 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-91015

Description

The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup on the site.