Description

The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.9 via the upload_template_kit function. This is due to incorrect authorization on the upload_template_kit() AJAX handler, which requires only upload_files capability instead of the manage_options required by all sibling handlers, combined with missing per-entry file type filtering after ZIP extraction. This makes it possible for authenticated attackers, with editor-level access and above, to upload files that may be executable, which makes remote code execution possible. Editors can satisfy the nonce requirement because the required nonces are localized on the standard Pages list screen, which is accessible to any user with the edit_pages capability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-01T05:17:09.887Z",
  "pubdate": "2026-09-01T05:17:09.887Z",
  "executiveSummary": "The Master Addons for Elementor plugin is susceptible to an Arbitrary File Upload vulnerability affecting versions up to and including 3.1.9. The vulnerability originates from insecure access control settings within the upload_template_kit() AJAX handler, which allows users with low-level administrative privileges (Editor-level and above) to bypass necessary permission checks.\nThe flaw occurs because the handler improperly validates authorization, requiring only 'upload_files' capabilities instead of the more restrictive 'manage_options' permission used by similar administrative functions. Furthermore, the application lacks rigorous server-side file type verification after the extraction of uploaded ZIP archives. Consequently, an authenticated attacker can leverage this weakness to upload arbitrary executable files to the web server.\nSuccessful exploitation facilitates Remote Code Execution (RCE), granting the attacker full control over the compromised WordPress instance. Because the necessary nonces are accessible to users with the 'edit_pages' capability, the barrier to entry for an authenticated attacker is minimal. This poses a critical risk to site integrity, confidentiality, and availability.",
  "technicalDetails": "The vulnerability resides within the 'upload_template_kit()' function of the Master Addons for Elementor plugin. The primary root cause is an improper authorization check combined with insufficient input validation during the file processing phase. While the plugin provides various administrative utilities that mandate 'manage_options' capabilities to prevent unauthorized access, the 'upload_template_kit()' AJAX handler incorrectly requires only the 'upload_files' capability. This discrepancy allows attackers with Editor-level access to trigger a function intended for higher-privileged users.\nThe exploitation flow begins with the attacker obtaining the required security nonce. These nonces are localized on the standard WordPress Pages list screen; because this screen is accessible to any user with 'edit_pages' capability, an attacker can easily retrieve the token needed to authenticate the AJAX request. Once the nonce is acquired, the attacker submits a malicious ZIP archive via the 'upload_template_kit()' handler.\nUpon receipt, the server extracts the archive contents. The plugin fails to perform per-entry file type filtering post-extraction. This omission is critical, as it allows for the inclusion of executable scripts—such as PHP shells—within the ZIP package. The application fails to sanitize or validate the file extensions of the extracted items before saving them to the filesystem.\nBy crafting a specifically formatted ZIP archive, an attacker can bypass the intended functionality and force the server to write arbitrary files to the directory structure. Because these files are saved within a location accessible via the web server's request/response cycle, the attacker can execute the uploaded code by directly accessing the file via HTTP/HTTPS. This results in arbitrary Remote Code Execution (RCE) on the underlying host, enabling the execution of system commands, lateral movement within the environment, or data exfiltration. The vulnerability is present in all versions up to 3.1.9, and because it relies on standard WordPress AJAX endpoints, it is exposed to any authenticated user with the specified privileges, regardless of their network location."
}