3.8
Faible
CVE-2026-84904 The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a…
Description
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing authenticated users with author-level access and above to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media belonging to other users, including administrators.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| King Addons for Elementor 51.1 | 51.1.56 → < 51.1.81 | 51.1.81 |
Autres CVE de King Addons for Elementor
Les 5 CVE de King Addons for Elementor →
CVE-2026-84903
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password…
2.7
Faible
CVE-2026-84902
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when…
6.8
Moyenne
CVE-2026-84896
The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before…
6.8
Moyenne
CVE-2026-14841
The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before…
6.1
Moyenne