CVE-2026-84903 in King Addons for Elementor Plugin
Summary
by MITRE • 09/18/2026
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and password-protected posts they are not authorized to access.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in King Addons for Elementor prior to version 51.1.81 represents a critical failure in access control mechanisms within WordPress plugin development. This flaw stems from the absence of proper capability verification, post-status validation, and password authentication checks before rendering content associated with user-supplied posts. In secure web application design, especially within Content Management Systems like WordPress, it is imperative that any function retrieving or displaying data respects the hierarchical permissions defined by the platform's role system. The specific implementation in King Addons bypasses these essential security gates, allowing the direct retrieval and display of post content based solely on the provided identifier without verifying whether the requesting user has legitimate authorization to view that specific piece of information.
From a technical perspective, this issue classifies as an Insecure Direct Object Reference or Broken Access Control vulnerability, aligning with CWE-639 in the Common Weakness Enumeration standard. The core defect lies in the plugin's reliance on external input without sanitization regarding user privileges. When a request is made to render post content, the application fails to cross-reference the current session's permissions against the required access level for the target post. Consequently, any authenticated user possessing Contributor-level access or higher can exploit this logic error. This includes users who may have limited editing rights but should not be permitted to view sensitive drafts, private articles intended only for specific audiences, or password-protected content that requires explicit authentication credentials.
The operational impact of this vulnerability is significant in terms of data confidentiality and integrity. Attackers with Contributor-level access can read the contents of posts marked as Private, Draft, Pending Review, or Password Protected. This exposure allows unauthorized users to gain insight into unpublished work, confidential business communications, or restricted information that was never intended for their consumption. In a corporate or multi-author environment, this could lead to the leakage of strategic plans, personal data, or proprietary content before it is officially released. Furthermore, because WordPress roles are often assigned based on trust levels within an organization, even lower-tier users can escalate their effective privileges by accessing restricted information, thereby undermining the principle of least privilege that underpins secure system administration.
This vulnerability also maps to specific tactics in the MITRE ATT&CK framework for enterprise security. It falls under the Initial Access and Discovery phases, specifically relating to T1078 Valid Accounts where an attacker uses legitimate credentials to access resources they are not authorized to view. Additionally, it relates to T1530 Data from Cloud Storage Objects if the posts contain sensitive files or data stored externally. The ability to enumerate and read private content facilitates further reconnaissance, allowing attackers to gather intelligence that could be used for more sophisticated attacks such as social engineering or targeted phishing campaigns based on the discovered information.
To mitigate this vulnerability, immediate action is required by updating the King Addons plugin to version 51.1.81 or later, where these access control checks have been properly implemented. Developers should ensure that all functions interacting with post data include rigorous validation of user capabilities using WordPress core functions such as current_user_can and get_post_status. It is essential to verify not only the existence of the post but also its status relative to the requesting user's role. For administrators, it is advisable to audit installed plugins for similar patterns where input-driven content rendering lacks proper authorization checks. Regular security audits and adherence to secure coding standards that prioritize explicit permission verification over implicit trust will prevent such access control failures in future updates.