WordPress Plugin Vulnerabilities

King Addons for Elementor < 24.12.59 - Missing Authorization

Description

The King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 24.12.58. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
king-addons
Fixed in 24.12.59

References

CVE
CVE-2025-30926
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/e8c1d1b1-5166-4230-aea0-cb708ff87de8

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
João Pedro Soares de Alcântara
Verified
No
WPVDB ID
add7f2fd-8ce5-4368-9d63-5ee6bed16b3f

Timeline

Publicly Published
2025-03-27 (about 11 months ago)
Added
2025-04-02 (about 11 months ago)
Last Updated
2025-04-02 (about 11 months ago)

Other

Published
Title
Published
2025-12-31
Title
Headinger for Elementor <= 1.1.4 - Missing Authorization
Published
2025-07-09
Title
Templazee <= 1.0.2 - Missing Authorization
Published
2024-12-11
Title
CoSchool LMS <= 1.4.3 - Missing Authorization to Privilege Escalation
Published
2024-12-12
Title
WP Crowdfunding < 2.1.13 - Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation
Published
2024-07-08
Title
Pie Register - Basic <= 3.8.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation/Deactivation