What is the CVSS score of CVE-2026-12349?

CVE-2026-12349 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

KingComposer Plugin CVE-2026-12349

EUVD-2026-40252 MEDIUM

Missing Authorization (CWE-862)

2026-06-30 Wordfence

GHSA-7m2v-4f6c-h555

WordPress Authentication Bypass Wordpress Plugin Premium Addons For Kingcomposer

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

6.5 MEDIUM

wp_ajax_nopriv_* registration requires PR:N; sidebar deletion causing silent widget rendering failure warrants A:L over the NVD-assigned A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 06:17 vuln.today

CVE Published

Jun 30, 2026 - 04:30 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Premium Addons for KingComposer plugin for WordPress is vulnerable to unauthorized modification and loss of data in versions up to, and including, 1.1.1. This is due to missing authorization and capability checks on the add_custom_sidebar() and remove_custom_sidebar() AJAX handlers, both of which are exposed through wp_ajax_nopriv_* hooks and write directly to the octagon_custom_sidebar option via update_option(). This makes it possible for unauthenticated attackers to create arbitrary custom widget areas or delete existing custom sidebars, which can cause widgets assigned to those areas to silently lose their registration and stop rendering.

AnalysisAI

Unauthenticated sidebar manipulation in the Premium Addons for KingComposer WordPress plugin (versions up to and including 1.1.1) allows any remote attacker to create arbitrary custom widget areas or permanently delete existing ones without any credentials. The root cause is that the AJAX handlers add_custom_sidebar() and remove_custom_sidebar() are registered under wp_ajax_nopriv_* hooks with no authorization or capability checks, granting public HTTP access to options-table writes via update_option(). Deletion of sidebars silently breaks widget rendering site-wide, and no public exploit has been identified at time of analysis; no CISA KEV listing is present.

Technical ContextAI

The Premium Addons for KingComposer plugin (CPE: cpe:2.3:a:octagonwebstudio:premium_addons_for_kingcomposer:*:*:*:*:*:*:*:*) extends the KingComposer WordPress page builder with custom sidebar/widget area management. WordPress exposes two AJAX hook namespaces: wp_ajax_* (authenticated users) and wp_ajax_nopriv_* (all users, including anonymous). The vulnerable class-sidebar.php file (lines 23, 68, 77, 92, 100 per the Trac repository) registers both add_custom_sidebar and remove_custom_sidebar actions exclusively under wp_ajax_nopriv_*, bypassing WordPress's built-in authentication gate entirely. Both handlers write directly to the WordPress options table via update_option('octagon_custom_sidebar', ...) without first calling current_user_can() or check_ajax_referer(). CWE-862 (Missing Authorization) precisely describes this pattern: privileged operations are reachable because authorization enforcement is entirely absent, not merely insufficient.

RemediationAI

No vendor-released patch with a confirmed fix version has been identified in the available data - patch availability is unknown at time of analysis. The primary remediation is to deactivate or uninstall the Premium Addons for KingComposer plugin immediately until a patched release is confirmed. As a targeted compensating control, a WordPress must-use plugin (mu-plugin) can be deployed to forcibly unregister the vulnerable actions via remove_action('wp_ajax_nopriv_add_custom_sidebar', ...) and remove_action('wp_ajax_nopriv_remove_custom_sidebar', ...) before they fire - this eliminates the attack surface without fully deactivating the plugin, though it will disable custom sidebar management functionality. Web application firewall rules blocking POST requests to wp-admin/admin-ajax.php with action=add_custom_sidebar or action=remove_custom_sidebar are an alternative network-layer control, but may interfere with other legitimate AJAX activity if not scoped precisely. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/5145b6bf-a726-4ef8-964f-63504bf7107e for patch release confirmation.