Master Addons for Elementor Premium <= 2.1.3 - Authenticated (Subscriber+) Remote Code Execution via render_preview

The impact of this RCE vulnerability is significant. An attacker with Subscriber privileges can gain complete control over the WordPress server hosting the affected website. This could lead to data breaches, website defacement, malware installation, and potentially, lateral movement to other systems on the network. The attacker could steal sensitive data stored within the WordPress database, including user credentials, customer information, and financial details. The ability to execute arbitrary code also allows for persistent backdoors, making the system vulnerable to future attacks even after the initial compromise is addressed.

Websites using Master Addons for Elementor Premium, particularly those with a large number of users or handling sensitive data, are at significant risk. Shared hosting environments are especially vulnerable as they often have limited control over plugin updates and security configurations. WordPress sites with weak user access controls, allowing Subscriber-level users broad permissions, are also at increased risk.

• wordpress: Use wp-cli to check plugin versions:

wp plugin list --status=active | grep Master Addons

• wordpress: Search plugin files for the vulnerable function JLTMAWidgetAdmin::render_preview using grep:

grep -r 'JLTMA_Widget_Admin::render_preview' /path/to/master-addons-for-elementor-premium

• generic web: Monitor access logs for requests to URLs containing JLTMAWidgetAdmin::render_preview. • generic web: Check response headers for unusual content or code execution indicators.

1. 2026-03-02Disclosure

   disclosure

1. Reserviert2026-02-24
2. Veröffentlicht2026-03-02
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation is to immediately upgrade Master Addons for Elementor Premium to version 2.1.4 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. A Web Application Firewall (WAF) can be configured to block access to the vulnerable JLTMAWidgetAdmin::render_preview endpoint. Additionally, restrict access to the WordPress admin panel to only authorized users with strong passwords and multi-factor authentication. Regularly review user roles and permissions to ensure the principle of least privilege is enforced.