The King Addons for Elementor plugin contains a critical access control flaw that allows authenticated users to potentially access restricted data.

The plugin fails to perform adequate authorization checks (CWE-862), allowing any authenticated user to exploit incorrectly configured access control security levels.

This vulnerability poses a significant risk to data confidentiality, as it permits unauthorized access to sensitive information that should be restricted based on user roles. With a CVSS score of 8.8, this flaw is categorized as High severity, necessitating prompt attention to prevent potential data exposure or unauthorized intelligence gathering by malicious actors within the user base.

Immediate Action: Monitor the official KingAddons developer channels for the release of a security update and apply it immediately upon availability.

Proactive Monitoring: Review web server and WordPress application access logs for unusual patterns involving the king-addons endpoint, specifically looking for access attempts by low-privileged user accounts.

Compensating Controls: Implement Web Application Firewall (WAF) rules to restrict access to sensitive plugin functions or to block requests containing suspicious parameters directed at the plugin's endpoints.

Public Exploit Available: Unknown.

Given the High severity rating, administrators must prioritize the security of their WordPress environment by restricting administrative access and auditing plugin configurations. Once the vendor releases a patched version, applying that update is the only definitive way to resolve the underlying authorization flaw. Until then, maintain strict oversight of user accounts and utilize WAF protections to mitigate potential exploitation.