CVE-2026-84904 King Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image Optimizer
Authenticated authors can bypass ownership checks to disclose paths, overwrite, and re-reference media files belonging to other users, including administrators.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-84904?
CVE-2026-84904 is a low-severity missing authorization vulnerability in Unknown King Addons for Elementor, published on 18 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing authenticated users with author-level access and above to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media belonging to other users, including administrators.
Weakness: CWE-862
Which versions are affected by CVE-2026-84904?
How do I fix CVE-2026-84904?
No fix has been published for CVE-2026-84904 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-84904 being exploited?
There is no known exploitation of CVE-2026-84904 in the wild and no public exploit code.
Sources
Also known as GHSA-pv3c-9qhj-4h2p.