Junglewise Threat Intelligence

CVE-2026-12349: Octagon Web Studio Premium Addons for KingComposer missing authorization in AJAX handlers

CVE-2026-12349 · Severity: medium · CVSS 5.3 · Published 2026-06-30

Executive brief

The Premium Addons for KingComposer plugin for WordPress, which provides additional design elements for the KingComposer page builder, contains a security flaw that allows unauthorized users to modify website layout settings. An attacker can remotely create or delete custom sidebar areas without needing to log in. This can lead to website defacement or the loss of important site content, as widgets assigned to deleted sidebars will stop appearing to visitors.

Technical details

The vulnerability is classified as Missing Authorization (CWE-862) within the add_custom_sidebar() and remove_custom_sidebar() AJAX handlers in the core/class-sidebar.php file. These handlers are improperly exposed via wp_ajax_nopriv_* hooks, allowing unauthenticated access. The functions perform direct writes to the 'octagon_custom_sidebar' option using update_option() without verifying user capabilities or intent. An attacker can exploit this to inject arbitrary sidebar names or delete existing ones, leading to the de-registration of widgets associated with those sidebars. The issue affects all versions up to and including 1.1.1.

Affected products

  • Octagon Web Studio Premium Addons for KingComposer up to, and including, 1.1.1

Timeline

  • 2026-06-30: advisory: NVD publication date
  • 2026-06-30: disclosed: Wordfence vulnerability report published

References