# Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.111 - Authenticated (Contributor+) Missing Authorization to Post Publishing via Change Post Status Ability

- **ID:** WPSEC-2026-1000
- **Plugin:** Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates (`premium-addons-for-elementor`), https://wordpress.org/plugins/premium-addons-for-elementor/
- **Affected versions:** from 4.11.87 before 4.11.112
- **Fixed in:** 4.11.112 (Update to 4.11.112 or later.)
- **Severity:** Low 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/premium-addons-for-elementor
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1000/

## Description

The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized post publishing via the change-post-status AI ability in versions 4.11.87 up to, and including, 4.11.111. This is due to the ability's permission callback only checking whether the user can edit the post, not whether they hold the post type's publish capability when setting the status to publish or private. This makes it possible for authenticated attackers, with contributor-level access and above, to publish posts they can edit and bypass editorial review, when the plugin's AI Abilities feature is enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-1000/
- https://plugins.svn.wordpress.org/premium-addons-for-elementor/tags/4.11.112/
- https://wordpress.org/plugins/premium-addons-for-elementor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1000/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.