CVE-2026-84904

Katalog CVE

CVSS 3.8 · Low EPSS 0,26%

Kerentanan Missing Authorization. Skor CVSS 3.1 3.8 (Low) menurut CISA ADP.

Deskripsi (NVD)

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing authenticated users with author-level access and above to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media belonging to other users, including administrators.

Rincian

Terbit di NVD

18 September 2026

Terakhir diubah

18 September 2026

Status NVD

Deferred

CVSS 3.1

3.8 (Low), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 15,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://wpscan.com/vulnerability/08ea6c9d-0bfd-4ad1-91d6-93d592867731/