{
 "id": "WPSEC-2026-1755",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1755/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1755/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1755/index.md",
 "title": "Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates <= 4.11.116 - Authenticated (Author+) Missing Authorization to Attachment Metadata Modification via Upload Media AI Ability",
 "description": "The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data via the Upload Media AI ability in versions 4.11.88 up to, and including, 4.11.116, due to a missing object-level capability check on the reused-attachment branch. The ability only checks the upload_files capability. When the supplied source URL matches an attachment that was added to the media library from that URL earlier, the caller's alt text and title are written to that attachment without checking that the caller can edit it. This makes it possible for authenticated attackers, with Author-level access and above, who know the source URL of such an attachment to overwrite the alt text and title of media uploaded by other users, including administrators. The AI Abilities feature must be enabled.",
 "plugin": {
  "slug": "premium-addons-for-elementor",
  "name": "Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates",
  "full_name": "Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates",
  "wordpress_org": "https://wordpress.org/plugins/premium-addons-for-elementor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/premium-addons-for-elementor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/premium-addons-for-elementor"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.11.88",
    "from_inclusive": true,
    "to": "4.11.117",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.11.88 before 4.11.117"
  ]
 },
 "introduced_in": "4.11.88",
 "fixed_in": "4.11.117",
 "remediation": "Update to 4.11.117 or later.",
 "fix_released": "2026-10-26T13:52:58+00:00",
 "published": "2026-10-27T13:53:32+00:00",
 "updated": "2026-10-27T13:38:20.258773+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1755/",
  "https://plugins.svn.wordpress.org/premium-addons-for-elementor/tags/4.11.117/",
  "https://wordpress.org/plugins/premium-addons-for-elementor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/premium-addons-for-elementor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-27"
 }
}