Is CVE-2026-66575 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66575 being exploited in the wild.

How severe is CVE-2026-66575?

Medium severity, with a CVSS score of 5.3, published 17 September 2026.

Which products and versions are affected?

King Addons for Elementor <=51.1.81.

Is there a fix for CVE-2026-66575?

A patch was published on 2026-09-17: Fixed in version 51.1.82 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-66575 attacked?

It is attacked over the network.

Am I affected by CVE-2026-66575?

Check whether you run King Addons for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66575: King Addons for Elementor insecure direct object reference

Q: Is there a fix for CVE-2026-66575?

A patch was published on 2026-09-17: Fixed in version 51.1.82 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-66575 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-66575?

Check whether you run King Addons for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66575 · Severity: medium · CVSS 5.3 · Published 2026-09-17

King Addons for Elementor is a popular WordPress plugin that extends the Elementor page builder with additional design components. An unauthenticated attacker can exploit an insecure direct object reference vulnerability to access and view other users' data by manipulating IDs in URLs, potentially exposing sensitive information without needing credentials.

Technologies: King Addons for Elementor. Vendors: King Addons.

Quick answers

Is CVE-2026-66575 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66575 being exploited in the wild.
How severe is CVE-2026-66575?: Medium severity, with a CVSS score of 5.3, published 17 September 2026.
Which products and versions are affected?: King Addons for Elementor <=51.1.81.
Is there a fix for CVE-2026-66575?: A patch was published on 2026-09-17: Fixed in version 51.1.82 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66575 attacked?: It is attacked over the network.
Am I affected by CVE-2026-66575?: Check whether you run King Addons for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an Insecure Direct Object Reference (IDOR) vulnerability classified under OWASP Top 10 A1 (Broken Access Control). The vulnerability exists in King Addons for Elementor versions up to 51.1.81 and can be exploited by unauthenticated attackers with network access. By modifying object identifiers in URLs, an attacker can bypass authorization checks and directly access or view data belonging to other users. No authentication is required and no user interaction is needed. The vulnerability has been patched in version 51.1.82 and later.

Affected products

King Addons King Addons for Elementor <=51.1.81

Timeline

2026-09-13: disclosed
2026-09-17: advisory
2026-09-17: patched: Fixed in version 51.1.82

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.