The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing authenticated users with author-level access and above to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media belonging to other users, including administrators.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 18 Sep 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing authenticated users with author-level access and above to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media belonging to other users, including administrators. | |
| Title | King Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image Optimizer | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-09-18T06:00:12.776Z
Reserved: 2026-09-02T15:25:53.441Z
Link: CVE-2026-84904
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-18T06:16:39.637
Modified: 2026-09-18T06:16:39.637
Link: CVE-2026-84904
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.