Broken Access Control in King Addons Live Chat REST Endpoints

Skrevet den af i King Addons for Elementor

Five Live Chat REST routes were registered with a permission callback of __return_true, leaving them open to unauthenticated callers, and a conversation update matched only on the conversation id. An attacker could read and modify other visitors’ conversations. The routes now verify a REST nonce and the update verifies the conversation belongs to the calling visitor.

This vulnerability affects the following application versions:

  • King Addons for Elementor 51.1.44
  • King Addons for Elementor 51.1.45
  • King Addons for Elementor 51.1.46
  • King Addons for Elementor 51.1.47
  • King Addons for Elementor 51.1.49
  • King Addons for Elementor 51.1.51
  • King Addons for Elementor 51.1.52
  • King Addons for Elementor 51.1.53
  • King Addons for Elementor 51.1.54
  • King Addons for Elementor 51.1.55
  • King Addons for Elementor 51.1.56
  • King Addons for Elementor 51.1.57
  • King Addons for Elementor 51.1.58
  • King Addons for Elementor 51.1.59
  • King Addons for Elementor 51.1.60
  • King Addons for Elementor 51.1.61
  • King Addons for Elementor 51.1.62

Information Disclosure in King Addons Maintenance Mode Page

Skrevet den af i King Addons for Elementor

The King Addons maintenance-mode renderer displayed whatever page or Elementor template was configured as the maintenance page without checking that the visitor was allowed to read it. Private, draft, pending and password-protected content was therefore served in full to unauthenticated visitors, bypassing WordPress’s own post-status and password protection. The fix checks current_user_can(‘read_post’, …) and post_password_required() before rendering and falls back to the password form or the built-in template.

This vulnerability affects the following application versions:

  • King Addons for Elementor 51.1.44
  • King Addons for Elementor 51.1.45
  • King Addons for Elementor 51.1.46
  • King Addons for Elementor 51.1.47
  • King Addons for Elementor 51.1.49
  • King Addons for Elementor 51.1.51
  • King Addons for Elementor 51.1.52
  • King Addons for Elementor 51.1.53
  • King Addons for Elementor 51.1.54
  • King Addons for Elementor 51.1.55
  • King Addons for Elementor 51.1.56
  • King Addons for Elementor 51.1.57
  • King Addons for Elementor 51.1.58
  • King Addons for Elementor 51.1.59
  • King Addons for Elementor 51.1.60
  • King Addons for Elementor 51.1.61
  • King Addons for Elementor 51.1.62
  • King Addons for Elementor 51.1.63
  • King Addons for Elementor 51.1.64
  • King Addons for Elementor 51.1.65
  • King Addons for Elementor 51.1.74
  • King Addons for Elementor 51.1.75
  • King Addons for Elementor 51.1.76
  • King Addons for Elementor 51.1.77
  • King Addons for Elementor 51.1.78
  • King Addons for Elementor 51.1.79

Missing Authorization in King Addons Image Optimizer AJAX Actions

Skrevet den af i King Addons for Elementor

The Image Optimizer AJAX handlers in King Addons for Elementor accepted an attachment ID from the request and acted on it without checking that the requesting user was allowed to edit that attachment. Any authenticated user who could reach these actions could optimize, restore, skip or read the optimization data of media owned by other users, and bulk endpoints returned attachment IDs the caller had no rights to. The fix adds per-attachment current_user_can(‘edit_post’, …) checks, filters bulk ID lists down to editable attachments, and limits listings to the caller’s own media unless they hold edit_others_posts.

This vulnerability affects the following application versions:

  • King Addons for Elementor 51.1.56
  • King Addons for Elementor 51.1.57
  • King Addons for Elementor 51.1.58
  • King Addons for Elementor 51.1.59
  • King Addons for Elementor 51.1.60
  • King Addons for Elementor 51.1.61
  • King Addons for Elementor 51.1.62
  • King Addons for Elementor 51.1.63
  • King Addons for Elementor 51.1.64
  • King Addons for Elementor 51.1.65
  • King Addons for Elementor 51.1.74
  • King Addons for Elementor 51.1.75
  • King Addons for Elementor 51.1.76
  • King Addons for Elementor 51.1.77
  • King Addons for Elementor 51.1.78
  • King Addons for Elementor 51.1.79

Missing Authorization in King Addons Template Catalog Import

Skrevet den af i King Addons for Elementor

The Template Catalog import AJAX handlers in King Addons for Elementor did not check whether the requesting user was allowed to edit the page being overwritten. Any authenticated user able to reach the action could replace the contents of pages belonging to other users. The fix adds a current_user_can(‘edit_post’, $page_id) capability check before the imported template is written.

This vulnerability affects the following application versions:

  • King Addons for Elementor 51.1.2
  • King Addons for Elementor 51.1.14
  • King Addons for Elementor 51.1.35
  • King Addons for Elementor 51.1.36
  • King Addons for Elementor 51.1.37
  • King Addons for Elementor 51.1.38
  • King Addons for Elementor 51.1.39
  • King Addons for Elementor 51.1.44
  • King Addons for Elementor 51.1.45
  • King Addons for Elementor 51.1.46
  • King Addons for Elementor 51.1.47
  • King Addons for Elementor 51.1.49
  • King Addons for Elementor 51.1.51
  • King Addons for Elementor 51.1.52
  • King Addons for Elementor 51.1.53
  • King Addons for Elementor 51.1.54
  • King Addons for Elementor 51.1.55
  • King Addons for Elementor 51.1.56
  • King Addons for Elementor 51.1.57
  • King Addons for Elementor 51.1.58
  • King Addons for Elementor 51.1.59
  • King Addons for Elementor 51.1.60
  • King Addons for Elementor 51.1.61
  • King Addons for Elementor 51.1.62
  • King Addons for Elementor 51.1.63
  • King Addons for Elementor 51.1.64
  • King Addons for Elementor 51.1.65
  • King Addons for Elementor 51.1.74
  • King Addons for Elementor 51.1.75
  • King Addons for Elementor 51.1.76
  • King Addons for Elementor 51.1.77
  • King Addons for Elementor 51.1.78
  • King Addons for Elementor 51.1.79

Stored Cross-Site Scripting in King Addons Button Animation Class

Skrevet den af i King Addons for Elementor

The Image Accordion, Pricing Table and Team Member widgets in King Addons for Elementor printed the button animation setting directly into the button’s HTML class attribute without escaping it. A user able to edit Elementor content could inject arbitrary attributes or markup that then executes in the browser of every visitor who views the page. The fix passes the value through sanitize_html_class() and esc_attr() before it is written to the class attribute.

This vulnerability affects the following application versions:

  • King Addons for Elementor 24.12.57
  • King Addons for Elementor 24.12.58
  • King Addons for Elementor 24.12.59
  • King Addons for Elementor 24.12.60
  • King Addons for Elementor 24.12.62
  • King Addons for Elementor 24.12.63
  • King Addons for Elementor 24.12.64
  • King Addons for Elementor 24.12.65
  • King Addons for Elementor 24.12.66
  • King Addons for Elementor 24.12.76
  • King Addons for Elementor 24.12.77
  • King Addons for Elementor 24.12.78
  • King Addons for Elementor 24.12.79
  • King Addons for Elementor 24.12.80
  • King Addons for Elementor 24.12.81
  • King Addons for Elementor 24.12.82
  • King Addons for Elementor 24.12.83
  • King Addons for Elementor 24.12.84
  • King Addons for Elementor 24.12.85
  • King Addons for Elementor 24.12.86
  • King Addons for Elementor 24.12.87
  • King Addons for Elementor 24.12.88
  • King Addons for Elementor 24.12.89
  • King Addons for Elementor 24.12.90
  • King Addons for Elementor 24.12.91
  • King Addons for Elementor 24.12.92
  • King Addons for Elementor 24.12.93
  • King Addons for Elementor 51.1.2
  • King Addons for Elementor 51.1.14
  • King Addons for Elementor 51.1.35
  • King Addons for Elementor 51.1.36
  • King Addons for Elementor 51.1.37
  • King Addons for Elementor 51.1.38
  • King Addons for Elementor 51.1.39
  • King Addons for Elementor 51.1.44
  • King Addons for Elementor 51.1.45
  • King Addons for Elementor 51.1.46
  • King Addons for Elementor 51.1.47
  • King Addons for Elementor 51.1.49
  • King Addons for Elementor 51.1.51
  • King Addons for Elementor 51.1.52
  • King Addons for Elementor 51.1.53
  • King Addons for Elementor 51.1.54
  • King Addons for Elementor 51.1.55
  • King Addons for Elementor 51.1.56
  • King Addons for Elementor 51.1.57
  • King Addons for Elementor 51.1.58
  • King Addons for Elementor 51.1.59
  • King Addons for Elementor 51.1.60
  • King Addons for Elementor 51.1.61
  • King Addons for Elementor 51.1.62
  • King Addons for Elementor 51.1.63
  • King Addons for Elementor 51.1.64
  • King Addons for Elementor 51.1.65
  • King Addons for Elementor 51.1.74
  • King Addons for Elementor 51.1.75
  • King Addons for Elementor 51.1.76
  • King Addons for Elementor 51.1.77
  • King Addons for Elementor 51.1.78
  • King Addons for Elementor 51.1.79

Broken Access Control in Pricing Table Builder REST endpoints

Skrevet den af i King Addons for Elementor

The `/king-addons/v1/pricing-table/list` and `/king-addons/v1/pricing-table/{id}` REST routes were registered with `’permission_callback’ => ‘__return_true’`, allowing unauthenticated retrieval of pricing-table configurations including draft/unpublished records. The fix in 51.1.63 replaces both permission callbacks with `current_user_can(‘manage_options’)` and additionally adds a per-record check that rejects non-published tables unless the caller has `edit_post` on that specific table.

This vulnerability affects the following application versions:

  • King Addons for Elementor 51.1.44
  • King Addons for Elementor 51.1.45
  • King Addons for Elementor 51.1.46
  • King Addons for Elementor 51.1.47
  • King Addons for Elementor 51.1.49
  • King Addons for Elementor 51.1.51
  • King Addons for Elementor 51.1.52
  • King Addons for Elementor 51.1.53
  • King Addons for Elementor 51.1.54
  • King Addons for Elementor 51.1.55
  • King Addons for Elementor 51.1.56
  • King Addons for Elementor 51.1.57
  • King Addons for Elementor 51.1.58
  • King Addons for Elementor 51.1.59
  • King Addons for Elementor 51.1.60
  • King Addons for Elementor 51.1.61
  • King Addons for Elementor 51.1.62

Stored XSS in Form Builder Submissions Admin List

Skrevet den af i King Addons for Elementor

The custom_date_key post-meta value (populated from a form’s custom-date field submission) was echoed directly into the admin submissions list column without escaping, so a script payload submitted through that field would execute in an administrator’s browser when viewing the submissions list. Fixed by wrapping the output in esc_html().

This vulnerability affects the following application versions:

  • King Addons for Elementor 24.12.83
  • King Addons for Elementor 24.12.84
  • King Addons for Elementor 24.12.85
  • King Addons for Elementor 24.12.86
  • King Addons for Elementor 24.12.87
  • King Addons for Elementor 24.12.88
  • King Addons for Elementor 24.12.89
  • King Addons for Elementor 24.12.90
  • King Addons for Elementor 24.12.91
  • King Addons for Elementor 24.12.92
  • King Addons for Elementor 24.12.93
  • King Addons for Elementor 51.1.2
  • King Addons for Elementor 51.1.14
  • King Addons for Elementor 51.1.35
  • King Addons for Elementor 51.1.36
  • King Addons for Elementor 51.1.37
  • King Addons for Elementor 51.1.38
  • King Addons for Elementor 51.1.39
  • King Addons for Elementor 51.1.44
  • King Addons for Elementor 51.1.45
  • King Addons for Elementor 51.1.46
  • King Addons for Elementor 51.1.47
  • King Addons for Elementor 51.1.49
  • King Addons for Elementor 51.1.51
  • King Addons for Elementor 51.1.52
  • King Addons for Elementor 51.1.53
  • King Addons for Elementor 51.1.54
  • King Addons for Elementor 51.1.55
  • King Addons for Elementor 51.1.56
  • King Addons for Elementor 51.1.57
  • King Addons for Elementor 51.1.58
  • King Addons for Elementor 51.1.59
  • King Addons for Elementor 51.1.60
  • King Addons for Elementor 51.1.61
  • King Addons for Elementor 51.1.62
  • King Addons for Elementor 51.1.63
  • King Addons for Elementor 51.1.64
  • King Addons for Elementor 51.1.65
  • King Addons for Elementor 51.1.74
  • King Addons for Elementor 51.1.75

Unauthenticated Arbitrary File Upload

Skrevet den af i King Addons for Elementor

Due to missing capability/nonce checks and improper file-type validation in the file upload handler, a remote attacker can upload files with dangerous extensions (e.g. PHP) to the server, which can then be executed as a web shell, leading to remote code execution on the affected WordPress site.

This vulnerability affects the following application versions:

  • King Addons for Elementor 24.12.83
  • King Addons for Elementor 24.12.84
  • King Addons for Elementor 24.12.85
  • King Addons for Elementor 24.12.86
  • King Addons for Elementor 24.12.87
  • King Addons for Elementor 24.12.88
  • King Addons for Elementor 24.12.89
  • King Addons for Elementor 24.12.90
  • King Addons for Elementor 24.12.91
  • King Addons for Elementor 24.12.92
  • King Addons for Elementor 24.12.93
  • King Addons for Elementor 51.1.2
  • King Addons for Elementor 51.1.14
  • King Addons for Elementor 51.1.35
  • King Addons for Elementor 51.1.36