CVE-2026-84903: King Addons for Elementor < 51.1.81 - Contributor+ Private Post Content Disclosure via kng_maintenance_page Shortcode
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and password-protected posts they are not authorized to access.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Contributor-level access or a higher role can exploit it. Anonymous visitors are not described as able to use this issue.
What does an attacker need to do to access restricted content?
The attacker needs to supply a target post through the kng_maintenance_page shortcode. The affected plugin renders that post's content without checking the user's capability, the post status, or its password protection.
Which content may be exposed?
Private, draft, pending, and password-protected posts may be disclosed. The affected user does not need to be authorized to read the selected post.
What version fixes the issue?
Upgrade King Addons for Elementor to version 51.1.81 or later. Versions before 51.1.81 are affected.