CyberRota Analysis
AI-GeneratedThe King Addons for Elementor WordPress plugin prior to version 51.1.81 lacks proper authorization checks for image-optimization actions, allowing authenticated users with author-level access and above to manipulate media files owned by other users, including administrators. This vulnerability can lead to unauthorized disclosure of file paths, overwriting of media content, and potential site-wide re-referencing of sensitive media. WordPress site administrators and users of the affected plugin should prioritize updating to the latest version to mitigate these risks.
Original NVD Description
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing authenticated users with author-level access and above to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media belonging to other users, including administrators.