What the vulnerability does
01Description
The King Addons for Elementor – 4,000+ ready Elementor sections, 650+ templates, 70+ FREE widgets for Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in all versions up to, and including, 51.1.49 due to the plugin adding the API keys to the HTML source code via render_full_form function. This makes it possible for unauthenticated attackers to extract site's Mailchimp, Facebook and Google API keys and secrets.
This vulnerability requires the Premium license to be installed
Explanation of Vulnerability in Simple Terms
02Summary
King Addons for Elementor exposes sensitive information to unauthenticated attackers over the network. The vulnerability allows an attacker to read data that should be restricted, such as configuration details or user information. No user interaction or special privileges are required. Update to a version newer than 51.1.49.
What an attacker can do
03Attacker Capabilities
Read sensitive information from the site without authentication.
Potential impact on your site
04Site Impact
Attackers can access restricted data like configuration or user details without logging in.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
March 23, 2026
CVE published
April 8, 2026
Record updated
