CVE-2026-12349

Name of the Vulnerable Software and Affected Versions Premium Addons for KingComposer versions prior to 1.1.2

Description Missing authorization and capability checks in the add custom sidebar() and remove custom sidebar() AJAX handlers allow unauthenticated attackers to modify or delete data. These handlers are exposed through wp ajax nopriv * hooks and write directly to the octagon custom sidebar option using the update option() function. This flaw enables the creation of arbitrary custom widget areas or the deletion of existing custom sidebars, which may cause widgets assigned to those areas to stop rendering.

Recommendations Update Premium Addons for KingComposer to version 1.1.2 or later.