CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
Missing Authorization vulnerability in KingAddons.com King Addons for Elementor king-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects King Addons for Elementor: from n/a through <= 51.1.61.
AnalysisAI
Broken access control in King Addons for Elementor (WordPress plugin) versions through 51.1.61 allows authenticated attackers with low privileges to bypass authorization checks and gain unauthorized access to high-privilege functionality. The CVSS 8.8 score reflects potential for full compromise (high confidentiality, integrity, and availability impact), though the EPSS score of 0.05% (15th percentile) indicates minimal real-world exploitation observed. No public exploit code or CISA KEV listing identified at time of analysis. The vulnerability stems from improperly configured access control security levels (CWE-862: Missing Authorization), enabling privilege escalation by low-privileged users.
Technical ContextAI
King Addons for Elementor is a WordPress plugin extending Elementor page builder functionality. This vulnerability represents a CWE-862 (Missing Authorization) flaw where the plugin fails to properly validate user permissions before granting access to sensitive operations. In WordPress plugins, this typically manifests through AJAX handlers, REST API endpoints, or admin functions that lack proper capability checks (e.g., missing current_user_can() validations). The CVSS vector indicates network-accessible exploitation (AV:N) with low attack complexity (AC:L) but requires authentication with low privileges (PR:L). Affected products run on WordPress installations where King Addons for Elementor plugin versions up to and including 51.1.61 are deployed. The authorization bypass allows authenticated users to execute functions intended for administrators or higher-privileged roles, violating principle of least privilege.
Affected ProductsAI
The vulnerability affects King Addons for Elementor WordPress plugin versions from the earliest available release through version 51.1.61 inclusive. This impacts WordPress installations running any version of the king-addons plugin within this range on any supported WordPress core version. The Patchstack reference indicates the vulnerability was identified in version 51.1.37 testing but applies to the full version range through 51.1.61. Site administrators should verify their installed plugin version via WordPress admin dashboard under Plugins section or by checking the plugin file headers. All WordPress sites with this plugin installed and active user registration or existing low-privilege user accounts should consider themselves potentially affected. Additional advisory details available at https://patchstack.com/database/Wordpress/Plugin/king-addons/vulnerability/wordpress-king-addons-for-elementor-plugin-51-1-37-broken-access-control-vulnerability.
RemediationAI
Site administrators should immediately upgrade King Addons for Elementor to version 51.1.62 or later if available, as the vulnerability affects all versions through 51.1.61. Check the WordPress plugin repository or vendor site KingAddons.com for the patched release and apply updates through the WordPress admin dashboard under Plugins > Installed Plugins. Prior to patch application, implement compensating controls: audit and restrict user registration to prevent unauthorized low-privilege account creation, review existing user accounts for suspicious registrations or compromised credentials, monitor WordPress admin logs for unauthorized access attempts to administrative functions, and consider temporarily disabling the plugin on non-production sites until patching is complete. After patching, verify the update by checking the plugin version number and conduct post-patch testing to ensure Elementor page functionality remains intact. For detailed vulnerability information and potential workarounds, consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/king-addons/vulnerability/wordpress-king-addons-for-elementor-plugin-51-1-37-broken-access-control-vulnerability. Implement defense-in-depth by enforcing strong password policies and multi-factor authentication for all user accounts to mitigate risk even if authorization flaws persist.
Share
External POC / Exploit Code
Leaving vuln.today