CVE-2026-66575 in King Addons for Elementor Plugin
Summary
by MITRE • 09/17/2026
Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified as an Unauthenticated Insecure Direct Object Reference within the King Addons for Elementor plugin, affecting versions up to and including 51.1.81, represents a critical security flaw rooted in insufficient access control mechanisms on the server side. This type of vulnerability allows attackers to manipulate input parameters that correspond directly to internal implementation objects such as database records or files without proper authorization checks. In this specific context, the plugin fails to verify whether the authenticated user has permission to access or modify the requested resource before processing the request. Because the flaw is unauthenticated, it does not require valid credentials to exploit, significantly lowering the barrier for entry and increasing the potential attack surface to include any internet-facing WordPress installation running the affected software.
From a technical perspective, Insecure Direct Object References occur when an application exposes internal object references such as file names or database keys directly in URLs or form parameters without validating that the requesting user is authorized to access them. The King Addons plugin likely accepts input variables related to specific addon configurations, template IDs, or asset files and passes these values directly into backend functions responsible for retrieving or updating data. Since there are no checks to ensure the current session belongs to an administrator or a user with appropriate privileges, an attacker can craft malicious requests that target arbitrary resources within the WordPress environment. This bypasses standard role-based access controls designed by the CMS framework itself, effectively granting unauthorized users elevated capabilities based solely on their ability to guess or enumerate valid object identifiers.
The operational impact of this vulnerability is severe and multifaceted depending on what specific objects are exposed through these endpoints. If the vulnerable endpoint allows for reading sensitive data, attackers could extract user information, site configurations, or proprietary content stored in the WordPress database. More critically, if the functionality permits write operations such as updating settings or deleting records, an attacker could deface websites, inject malicious code into templates, or completely disrupt service availability by removing essential addon configurations. This can lead to a complete compromise of the web application's integrity and confidentiality. Furthermore, because Elementor is widely used for page building, compromising these addons often serves as a stepping stone for further attacks against the underlying WordPress core or other plugins that share database tables or session contexts.
This vulnerability aligns closely with CWE-639, which defines Insecure Direct Object Reference as a flaw where an application uses user-supplied input to access objects directly without proper authorization checks. It also maps to MITRE ATT&CK technique T1078, specifically Valid Accounts if the attacker were to use stolen credentials, but in this unauthenticated case, it reflects broader principles of Broken Access Control (T1288) where the system fails to enforce intended restrictions on authorized users and actions. The lack of authentication requirement places this flaw in a high-severity category according to common vulnerability scoring systems due to its ease of exploitation by automated tools that can rapidly enumerate object IDs across thousands of installations.
Mitigation strategies must prioritize immediate remediation through software updates. Administrators running King Addons for Elementor should upgrade to the latest patched version where developers have implemented strict validation logic and authorization checks before processing any requests involving direct object references. Until an update is applied, temporary mitigations include restricting access to WordPress admin areas via IP whitelisting if feasible, although this does not fully protect public-facing endpoints exposed by plugins. Additionally, deploying a Web Application Firewall can help detect and block suspicious patterns of parameter manipulation that are characteristic of IDOR exploitation attempts. Regular security audits focusing on input validation and authorization logic in custom or third-party code are essential to prevent similar vulnerabilities from being introduced in future updates or other plugin integrations.