CVE-2026-3132 PUBLISHED

Master Addons for Elementor Premium <= 2.1.3 - Authenticated (Subscriber+) Remote Code Execution via render_preview

Assigner: Wordfence
Reserved: 24.02.2026 Published: 02.03.2026 Updated: 02.03.2026

The Master Addons for Elementor Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.1.3 via the 'JLTMA_Widget_Admin::render_preview'. This is due to missing capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute code on the server.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Product Status

Vendor Jewel Theme
Product Master Addons for Elementor Premium
Versions Default: unaffected
  • affected from * to 2.1.3 (incl.)

Credits

  • Ren Voza finder

References

Problem Types

  • CWE-94 Improper Control of Generation of Code ('Code Injection') CWE