CVE-2026-84903 King Addons for Elementor < 51.1.81 - Contributor+ Private Post Content Disclosure via kng_maintenance_page Shortcode
Contributors can read private, draft, and password-protected post content via a shortcode due to missing authorization checks in King Addons for Elementor.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-84903?
CVE-2026-84903 is a low-severity vulnerability in Unknown King Addons for Elementor, published on 18 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and password-protected posts they are not authorized to access.
Weakness: CWE-200
Which versions are affected by CVE-2026-84903?
How do I fix CVE-2026-84903?
No fix has been published for CVE-2026-84903 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-84903 being exploited?
There is no known exploitation of CVE-2026-84903 in the wild and no public exploit code.
Sources
Also known as GHSA-gwpw-wwmj-xgqp.