Description
The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup on the site.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Master Addons for Elementor | 3.0.0 – < 3.1.9 | 3.1.9 |
References
- https://wpscan.com/vulnerability/e052c684-7b82-4555-8bf7-600b894264db/ exploit vdb-entry technical-description