The Image Optimizer AJAX handlers in King Addons for Elementor accepted an attachment ID from the request and acted on it without checking that the requesting user was allowed to edit that attachment. Any authenticated user who could reach these actions could optimize, restore, skip or read the optimization data of media owned by other users, and bulk endpoints returned attachment IDs the caller had no rights to. The fix adds per-attachment current_user_can(‘edit_post’, …) checks, filters bulk ID lists down to editable attachments, and limits listings to the caller’s own media unless they hold edit_others_posts.
This vulnerability affects the following application versions:
- King Addons for Elementor 51.1.56
- King Addons for Elementor 51.1.57
- King Addons for Elementor 51.1.58
- King Addons for Elementor 51.1.59
- King Addons for Elementor 51.1.60
- King Addons for Elementor 51.1.61
- King Addons for Elementor 51.1.62
- King Addons for Elementor 51.1.63
- King Addons for Elementor 51.1.64
- King Addons for Elementor 51.1.65
- King Addons for Elementor 51.1.74
- King Addons for Elementor 51.1.75
- King Addons for Elementor 51.1.76
- King Addons for Elementor 51.1.77
- King Addons for Elementor 51.1.78
- King Addons for Elementor 51.1.79