Description
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and password-protected posts they are not authorized to access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | King Addons for Elementor | < 51.1.81 | 51.1.81 |
References
- https://wpscan.com/vulnerability/57853db6-c9e0-4b0a-8a57-8287f0e85eea/ exploit vdb-entry technical-description