rootpwn

high · CVSS v3 7.1

CVE-2026-84904

King Addons for Elementor WordPress plugin before version 51.1.81 lacks proper object-level authorization for specific image optimization ac

Overview

King Addons for Elementor WordPress plugin before version 51.1.81 lacks proper object-level authorization for specific image optimization actions. This allows authenticated users with author-level privileges to perform unauthorized manipulations on media objects belonging to other users. Consequently, attackers can disclose absolute file paths, overwrite file bytes, and re-reference media site-wide.

Description

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing authenticated users with author-level access and above to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media belonging to other users, including administrators.

Impact

This vulnerability impacts the Confidentiality and Integrity of media objects within the WordPress site. An authenticated attacker with low privileges (author level) can access sensitive server paths, alter administrative files, and manipulate media assets. Administrators and other users with media ownership are directly affected by unauthorized modifications.

Remediation

Update the King Addons for Elementor plugin to version 51.1.81 or later where the missing authorization checks are properly implemented. Regularly audit user role assignments to ensure principle of least privilege is enforced.

Risk context

The vulnerability carries a CVSS v3 score of 7.1, indicating a high risk level for affected WordPress installations. Immediate patching is recommended to prevent unauthorized administrative media manipulation.

Affected products

  • King Addons for Elementor

Scores

Severity
high
CVSS v2
5.5
CVSS v3
7.1
CVSS v4
—
EPSS
—

wordpress plugin authorization insecure-direct-object-references file-overwrite path-disclosure

← All CVEs

Related CVEs

high

CVE-2026-93455

django-page-cms through version 2.0.13 contains an authorization bypass vulnerability in its admin helper views. The flaw allows low-privilege staff accounts to read unpublished drafts, page listings, and stored media paths without proper permission validation. This matters because it exposes sensitive organizational content to internal users who should not have access.

View analysis

high

CVE-2026-52727

The lxc-ci project inadvertently included a static pacman local-signing private key within Arch Linux container and virtual machine images built prior to May 28, 2026. This allows a malicious or compromised package mirror to issue cryptographically trusted packages to clients. Consequently, attackers can achieve arbitrary code execution as root on affected systems.

View analysis

high

CVE-2026-77169

A authorization bypass vulnerability exists in the team folders app when used alongside the workspace app. This flaw allows API-only delegated administrators to circumvent folder-level access restrictions. It matters because it undermines multi-tenant isolation and administrative privilege boundaries.

View analysis

high

CVE-2026-93313

An integer overflow vulnerability exists in Freedesktop Poppler version 26.07.0 within the JBIG2Stream::readCodeTableSeg function in poppler/JBIG2Stream.cc. This flaw can be triggered remotely via malicious PDF files containing crafted JBIG2 streams. It matters because successful exploitation could lead to application crashes or potentially arbitrary code execution in environments processing untrusted documents.

View analysis