Executive brief
King Addons for Elementor is a popular WordPress plugin that extends the Elementor page builder with additional design components and features. The plugin fails to properly verify user permissions when handling image optimization tasks, allowing lower-privileged users (such as authors) to access, modify, or repurpose media files belonging to other users, including administrators. This can lead to unauthorized disclosure of file paths, data corruption, and site-wide integrity issues.
Technical details
The vulnerability is a missing per-object authorization (broken access control, CWE-862) in the image optimizer functionality. The plugin gates image-optimization actions only on a coarse capability check that lower-privileged users also possess, and fails to verify ownership of the targeted media object. An authenticated user with author-level access or above can exploit this to disclose absolute file paths, overwrite file contents, and re-reference media across the entire site without ownership validation. The vulnerability affects versions before 51.1.81, and is patched in 51.1.81.
Affected products
- King Addons King Addons for Elementor before 51.1.81
Timeline
- 2026-09-16: disclosed
- 2026-09-18: published
- 2026-09-18: patched: Fixed in version 51.1.81