The King Addons maintenance-mode renderer displayed whatever page or Elementor template was configured as the maintenance page without checking that the visitor was allowed to read it. Private, draft, pending and password-protected content was therefore served in full to unauthenticated visitors, bypassing WordPress’s own post-status and password protection. The fix checks current_user_can(‘read_post’, …) and post_password_required() before rendering and falls back to the password form or the built-in template.
This vulnerability affects the following application versions:
- King Addons for Elementor 51.1.44
- King Addons for Elementor 51.1.45
- King Addons for Elementor 51.1.46
- King Addons for Elementor 51.1.47
- King Addons for Elementor 51.1.49
- King Addons for Elementor 51.1.51
- King Addons for Elementor 51.1.52
- King Addons for Elementor 51.1.53
- King Addons for Elementor 51.1.54
- King Addons for Elementor 51.1.55
- King Addons for Elementor 51.1.56
- King Addons for Elementor 51.1.57
- King Addons for Elementor 51.1.58
- King Addons for Elementor 51.1.59
- King Addons for Elementor 51.1.60
- King Addons for Elementor 51.1.61
- King Addons for Elementor 51.1.62
- King Addons for Elementor 51.1.63
- King Addons for Elementor 51.1.64
- King Addons for Elementor 51.1.65
- King Addons for Elementor 51.1.74
- King Addons for Elementor 51.1.75
- King Addons for Elementor 51.1.76
- King Addons for Elementor 51.1.77
- King Addons for Elementor 51.1.78
- King Addons for Elementor 51.1.79