PT-2026-53810 · WordPress · Premium Addons For Kingcomposer

Eason · Published 2026-06-30 · Updated 2026-06-30 · CVE-2026-12349

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Premium Addons for KingComposer versions prior to 1.1.2

Description Missing authorization and capability checks in the add custom sidebar() and remove custom sidebar() AJAX handlers allow unauthenticated attackers to modify or delete data. These handlers are exposed through wp ajax nopriv * hooks and write directly to the octagon custom sidebar option using the update option() function. This flaw enables the creation of arbitrary custom widget areas or the deletion of existing custom sidebars, which may cause widgets assigned to those areas to stop rendering.

Recommendations Update Premium Addons for KingComposer to version 1.1.2 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-12349

Affected Products

Premium Addons For Kingcomposer

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-12349 · Security Note
• https://plugins.trac.wordpress.org/browser/premium-addons-for-kingcomposer/trunk/core/class-sidebar.php#L68 · Note
• https://twitter.com/VulmonFeeds/status/2071850966362525782 · Twitter Post
• https://plugins.trac.wordpress.org/browser/premium-addons-for-kingcomposer/trunk/core/class-sidebar.php#L77 · Note
• https://plugins.trac.wordpress.org/browser/premium-addons-for-kingcomposer/trunk/core/class-sidebar.php#L92 · Note
• https://plugins.trac.wordpress.org/browser/premium-addons-for-kingcomposer/trunk/core/class-sidebar.php#L100 · Note
• https://plugins.trac.wordpress.org/browser/premium-addons-for-kingcomposer/trunk/core/class-sidebar.php#L23 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/5145b6bf-a726-4ef8-964f-63504bf7107e?source=cve · Note