CVE-2026-84903

King Addons for Elementor < 51.1.81 - Contributor+ Private Post Content Disclosure via kng_maintenance_page Shortcode

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and password-protected posts they are not authorized to access.

Affected

King Addons for Elementor

CVSS v3.1 CNA

2.7 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

EPSS

0.32% chance of exploitation in the next 30 days, 23rd percentile

Published

2026-09-18

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/57853db6-c9e0-4b0a-8a57-8287f0e85eea/

References

• CVE Record
• NVD entry