# King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder <= 51.1.87 - Unauthenticated Sensitive Information Exposure via Faceted Filters AJAX Widget Rendering

- **ID:** WPSEC-2026-2813
- **Plugin:** King Addons for Elementor – 100+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce Builder, Mega Menu, Popup Builder (`king-addons`), https://wordpress.org/plugins/king-addons/
- **Affected versions:** all versions before 51.1.90
- **Fixed in:** 51.1.90 (Update to 51.1.90 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/king-addons
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2813/

## Description

The King Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure via the Shop Filters (Faceted Filters) AJAX action king_addons_faceted_filters in all versions up to, and including, 51.1.87. This is due to the handler loading and rendering any saved Elementor element identified by user-supplied 'post_id' and 'widget_id' values, without checking that the document is published and not password-protected or that the element is a filter-enabled grid. The nonce it checks is printed on public pages. This makes it possible for unauthenticated attackers who know an element ID to render content from private, draft or password-protected Elementor documents.

## References

- https://wpsec.com/vuln/WPSEC-2026-2813/
- https://plugins.svn.wordpress.org/king-addons/tags/51.1.90/
- https://wordpress.org/plugins/king-addons/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2813/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.