Skip to content
Sign in
3.8 Low

CVE-2026-84904 The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a…

Description

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing authenticated users with author-level access and above to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media belonging to other users, including administrators.

Affected products and versions

Product Affected versions Fixed in
King Addons for Elementor 51.1 51.1.56 → < 51.1.81 51.1.81

Other CVEs of King Addons for Elementor

The 5 CVEs of King Addons for Elementor →
CVE-2026-84903 The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password… 2.7 Low CVE-2026-84902 The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when… 6.8 Medium CVE-2026-84896 The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before… 6.8 Medium CVE-2026-14841 The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before… 6.1 Medium
Track this CVE