The `/king-addons/v1/pricing-table/list` and `/king-addons/v1/pricing-table/{id}` REST routes were registered with `’permission_callback’ => ‘__return_true’`, allowing unauthenticated retrieval of pricing-table configurations including draft/unpublished records. The fix in 51.1.63 replaces both permission callbacks with `current_user_can(‘manage_options’)` and additionally adds a per-record check that rejects non-published tables unless the caller has `edit_post` on that specific table.
This vulnerability affects the following application versions:
- King Addons for Elementor 51.1.44
- King Addons for Elementor 51.1.45
- King Addons for Elementor 51.1.46
- King Addons for Elementor 51.1.47
- King Addons for Elementor 51.1.49
- King Addons for Elementor 51.1.51
- King Addons for Elementor 51.1.52
- King Addons for Elementor 51.1.53
- King Addons for Elementor 51.1.54
- King Addons for Elementor 51.1.55
- King Addons for Elementor 51.1.56
- King Addons for Elementor 51.1.57
- King Addons for Elementor 51.1.58
- King Addons for Elementor 51.1.59
- King Addons for Elementor 51.1.60
- King Addons for Elementor 51.1.61
- King Addons for Elementor 51.1.62