This vulnerability allows an authenticated user with at least editor-level access to upload arbitrary files through the plugin’s upload_template_kit AJAX handler. The handler mistakenly authorizes upload_files capability instead of the intended manage_options level, and after extracting the uploaded ZIP it fails to filter file types. An attacker can therefore add executable or malicious content that will run with the site’s permissions, directly compromising the WordPress installation. The flaw is categorized as an Authorization Bypass. The described impact is the potential for full system compromise via executable uploads.

The flaw exists in the Master Addons for Elementor plugin for WordPress, provided by pixarlabs, and affects all versions up to and including 3.1.9. Users who have installed these versions should be aware that editor, author, or higher level roles could be abused to trigger the upload and extraction process.

The CVSS score of 7.2 indicates high severity, with a significant likelihood that an attacker could leverage the flaw due to its reliance on standard user capabilities and nonces that are accessible to any editor. While no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the nature of the flaw means that it can be exploited in a straightforward manner by an authenticated user. The attack vector is local and requires valid credentials; thus, mitigating user permissions and updating the plugin are critical steps to prevent exploitation.