The Master Addons for Elementor Premium plugin for WordPress contains a critical code injection vulnerability that allows authenticated attackers to execute arbitrary code on the server.

This vulnerability is a code injection flaw (CWE-94) occurring within the JLTMA_Widget_Admin::render_preview function. It arises from a missing capability check, which allows any authenticated user with Subscriber-level access or higher to trigger remote code execution.

Successful exploitation allows an attacker to execute arbitrary commands on the underlying web server, leading to a complete compromise of the WordPress installation. With a CVSS score of 8.8, this vulnerability poses a severe threat, as it enables unauthorized data access, potential lateral movement within the network, and full control over the application environment.

Immediate Action: Update the Master Addons for Elementor Premium plugin to the latest version released after 2.1.3 to incorporate the necessary capability checks.

Proactive Monitoring: Monitor server logs for suspicious activity involving the JLTMA_Widget_Admin class or unexpected system-level command execution initiated by the web server process.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests to the widget preview endpoint, which may help mitigate exploitation attempts until the plugin is updated.

Public Exploit Available: Unknown.

Given the high CVSS score and the critical nature of remote code execution, organizations using the Master Addons for Elementor Premium plugin must prioritize applying the vendor update immediately. If an update cannot be applied promptly, consider disabling or removing the plugin to eliminate the attack surface entirely.