CVE-2026-3132 - Vulnerability Analysis

Overview

Master Addons for Elementor Premium plugin for WordPress <= 2.1.3 contains a remote code execution caused by missing capability check in JLTMA_Widget_Admin::render_preview, letting authenticated attackers with Subscriber-level access execute code on the server.

Severity & Score

Impact

Authenticated attackers with Subscriber-level access can execute arbitrary code on the server, potentially leading to full system compromise.

Mitigation

Update to a version later than 2.1.3 or the latest available version.

References

• https://plugins.trac.wordpress.org/browser/master-addons/tags/2.1.3/inc/admin/widget-builder/class-jltma-widget-admin.php#L1127
• https://plugins.trac.wordpress.org/changeset/3471598/master-addons/trunk/inc/admin/widget-builder/class-jltma-widget-admin.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/76c31190-9db9-4d14-83e0-cbfca812e8ea?source=cve

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 2, 2026

🟠 CVE-2026-3132 - High (8.8) The Master Addons for Elementor Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.1.3 via the 'JLTMA_Widget_Admin::render_preview'. This is due to missing capability check. This makes it po... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3132/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner