CVE-2026-84903 PUBLISHED

King Addons for Elementor < 51.1.81 - Contributor+ Private Post Content Disclosure via kng_maintenance_page Shortcode

Assigner: WPScan
Reserved: 02.09.2026 Published: 18.09.2026 Updated: 18.09.2026

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and password-protected posts they are not authorized to access.

Product Status

Vendor Unknown
Product King Addons for Elementor
Versions Default: unaffected
  • affected from 0 to 51.1.81 (excl.)

Credits

  • Revanth Hari Narayana Matte finder
  • WPScan coordinator

References

Problem Types

  • CWE-200 Information Exposure CWE