{
 "id": "WPSEC-2026-1000",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1000/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1000/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1000/index.md",
 "title": "Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.111 - Authenticated (Contributor+) Missing Authorization to Post Publishing via Change Post Status Ability",
 "description": "The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized post publishing via the change-post-status AI ability in versions 4.11.87 up to, and including, 4.11.111. This is due to the ability's permission callback only checking whether the user can edit the post, not whether they hold the post type's publish capability when setting the status to publish or private. This makes it possible for authenticated attackers, with contributor-level access and above, to publish posts they can edit and bypass editorial review, when the plugin's AI Abilities feature is enabled.",
 "plugin": {
  "slug": "premium-addons-for-elementor",
  "name": "Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates",
  "full_name": "Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates",
  "wordpress_org": "https://wordpress.org/plugins/premium-addons-for-elementor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/premium-addons-for-elementor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/premium-addons-for-elementor"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.11.87",
    "from_inclusive": true,
    "to": "4.11.112",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.11.87 before 4.11.112"
  ]
 },
 "introduced_in": "4.11.87",
 "fixed_in": "4.11.112",
 "remediation": "Update to 4.11.112 or later.",
 "fix_released": "2026-10-14T09:46:08+00:00",
 "published": "2026-10-15T10:51:54+00:00",
 "updated": "2026-10-14T19:51:13.066693+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1000/",
  "https://plugins.svn.wordpress.org/premium-addons-for-elementor/tags/4.11.112/",
  "https://wordpress.org/plugins/premium-addons-for-elementor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/premium-addons-for-elementor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-15"
 }
}