KingAddons for Elementor is missing an authorization check, allowing an attacker to access restricted plugin functionality. The weakness is described as a Classic Unauthenticated Read Vulnerability (CWE-862). If successfully exploited, the attacker could use privileged actions normally limited to authenticated or higher‑level users, potentially compromising data confidentiality or integrity within the WordPress site.

WordPress installations that include King Addons for Elementor plugin version 51.1.61 or earlier are affected. The vulnerability applies to all WordPress sites that have installed the plugin up to the specified version threshold.

The CVSS score of 6.5 classifies the flaw as medium severity, while an EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV, suggesting no known active exploitation. Nonetheless, the missing authorization check means an attacker who can reach the plugin’s endpoints could create or modify content, potentially leading to broader site compromise. No specific attack vector is stated in the data; it is inferred that any user with basic access can attempt to exploit the exposed resource paths.