CVE-2026-84904: Unknown King Addons For Elementor

Low severity, CVSS 3.8. EPSS: 0.3% chance of exploitation in the next 30 days.

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing authenticated users with author-level access and above to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media belonging to other users, including administrators.

Affected products

• Unknown King Addons For Elementor: from 51.1.56, before 51.1.81 (fixed in 51.1.81)

Published 2026-09-18. Last modified 2026-09-18.