CVE-2026-3132 - Vulnerability Analysis
HighCVSS: 8.8Last Updated: March 2, 2026
Master Addons for Elementor Premium - Remote Code Execution
Published: March 2, 2026Updated: March 2, 2026Remote Exploitable
Overview
Master Addons for Elementor Premium plugin for WordPress <= 2.1.3 contains a remote code execution caused by missing capability check in JLTMA_Widget_Admin::render_preview, letting authenticated attackers with Subscriber-level access execute code on the server.
Severity & Score
Severity: High
CVSS Score: 8.8
Impact
Authenticated attackers with Subscriber-level access can execute arbitrary code on the server, potentially leading to full system compromise.
Mitigation
Update to a version later than 2.1.3 or the latest available version.
References
- https://plugins.trac.wordpress.org/browser/master-addons/tags/2.1.3/inc/admin/widget-builder/class-jltma-widget-admin.php#L1127
- https://plugins.trac.wordpress.org/changeset/3471598/master-addons/trunk/inc/admin/widget-builder/class-jltma-widget-admin.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/76c31190-9db9-4d14-83e0-cbfca812e8ea?source=cve
Related Resources
Details
- CVE ID
- CVE-2026-3132
- Severity
- High
- CVSS Score
- 8.8
- Type
- remote_code_execution
- Status
- unconfirmed
CWE
- CWE-94
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H