CVE-2026-84904

Name of the Vulnerable Software and Affected Versions King Addons for Elementor versions prior to 51.1.81

Description The plugin fails to perform per-object authorization checks for image-optimization actions. It relies on a coarse capability shared by lower-privileged users and does not verify ownership of the targeted object. This allows authenticated users with author-level access or higher to disclose absolute file paths, overwrite bytes, and re-reference media belonging to other users, including administrators.

Recommendations Update to version 51.1.81 or later.