Vulnerability · Published Sep 18, 2026 · Assigned by WPScan

CVE-2026-84904King Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image Optimizer

Low 3.8

In plain English

A low-severity missing authorization in King Addons for Elementor from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)3.8Low

Exploit odds (30 days)0.3%top 82.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing authenticated users with author-level access and above to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media belonging to other users, including administrators.

Affected products (as reported)

Vendor	Product	Versions
Unknown	King Addons for Elementor	51.1.56 – before 51.1.81

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

References

https://wpscan.com/vulnerability/08ea6c9d-0bfd-4ad1-91d6-93d592867731/ exploit, vdb-entry, technical-description