King Addons for Elementor: Broken access control in WordPress plugin
Summary
King Addons for Elementor is a WordPress plugin that adds widgets and templates to the Elementor page builder. Versions up to and including 51.1.87 contain a missing authorization check (CWE-862) that allows users to reach functions they should not be allowed to use. According to the CNA's CVSS 3.1 vector, the attack is network-based and needs no login or user interaction, with only a limited confidentiality impact. The specific vulnerable function is not publicly documented.
Affected
- King Addons for Elementor up to and including 51.1.87
- Earliest affected version: Unknown.
Fixed in
- Version 51.1.90 (according to Patchstack; not yet confirmed in the vendor changelog)
Workaround
- No vendor workaround known.
- Until the update is applied, restrict which WordPress accounts can access the plugin's features.
Exploitation
- Not known to be exploited, according to one aggregator.
- No public proof of concept, CISA KEV listing or GitHub advisory found.
- Earlier King Addons CVEs (e.g. CVE-2025-8489) were exploited in the wild, but that applies to a different CVE.
Our recommendation
- Update King Addons for Elementor to version 51.1.90 or later, preferably in the next maintenance window.
- Check whether the plugin is installed on internet-facing WordPress sites.
- Review user accounts for unexpected administrators and check pages and content for unauthorized changes.
- Verify the fixed version in the plugin changelog on WordPress.org or king-addons.com.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory for CVE-2026-125444 patchstack.com
- CVE Record CVE-2026-125444 www.cve.org
- OffSeq Radar aggregator entry radar.offseq.com
- Strix CVE entry CVE-2026-125444 www.strix.ai
- 365i blog on King Addons vulnerability fix www.365i.co.uk
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:47.
Original description (NVD)
Missing Authorization vulnerability in King Addons King Addons for Elementor king-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects King Addons for Elementor: from n/a through 51.1.87.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.