CVE-2026-84904
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating…
Impact
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing authenticated users with author-level access and above to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media belonging to other users, including administrators.
Affected products
| Product | Affected versions |
|---|---|
| King Addons For Elementor WordPress Plugin | before 51.1.81 |
Versions were read from the advisory text. No structured product data has been published for this record yet.