Executive brief
King Addons for Elementor is a WordPress plugin that extends Elementor page builder with additional widgets and features. The plugin fails to properly validate user permissions when rendering post content through a shortcode, allowing contributors and higher-level users to view private, draft, pending, and password-protected posts they should not have access to. This exposes sensitive content and draft materials that were intended to be hidden.
Technical details
The vulnerability is an information disclosure (CWE-200) caused by missing access control checks in the kng_maintenance_page shortcode handler. The plugin renders user-supplied post content without verifying the user's capabilities, post status, or password protection. An authenticated user with Contributor-level access or above can exploit this by specifying a post ID in the shortcode parameters to read content they are not authorized to access. The vulnerability requires authentication and existing plugin use, but no special interaction beyond shortcode parameter manipulation is needed.
Affected products
- King Addons King Addons for Elementor before 51.1.81
Timeline
- 2026-09-16: disclosed
- 2026-09-18: patched: Version 51.1.81 fixes the vulnerability