CVE-2026-12349: Premium Addons for KingComposer Unauthorized Sidebar Modification

Technical summary

The vulnerability exists in the add_custom_sidebar() and remove_custom_sidebar() AJAX handlers in Premium Addons for KingComposer up to version 1.1.1. These handlers are registered via wp_ajax_nopriv_* hooks, making them executable by unauthenticated users. The handlers directly modify the octagon_custom_sidebar WordPress option using update_option() without any prior authorization or capability checks. An attacker can invoke these endpoints to create arbitrary custom widget areas or delete existing sidebars, resulting in widget deregistration and loss of display functionality.

Business impact

Site owners relying on custom sidebars for content organization may experience unexpected widget disappearance without obvious cause, degrading user experience and potentially disrupting site layout. If custom sidebars are used to display business-critical content (promotions, navigation, calls-to-action), an attacker could selectively disrupt those areas. While not a data breach vulnerability, the ability to modify site structure without authorization violates integrity expectations and could be leveraged as part of a broader defacement or disruption campaign.

Affected systems

WordPress installations running Premium Addons for KingComposer plugin in version 1.1.1 or earlier are affected. The vulnerability affects all instances regardless of WordPress version or plugin configuration, as the flaw exists in the plugin's AJAX handler registration itself.

Exploitability

Exploitation requires only network access and knowledge of the AJAX endpoint names and parameter structure. No authentication, user interaction, or site-specific configuration is necessary. An attacker can automate attacks to target multiple sites running the vulnerable plugin. The attack surface is public-facing, making reconnaissance straightforward.

Remediation

Update Premium Addons for KingComposer to a patched version released after 1.1.1 (verify against the vendor advisory for the specific version number). The fix should add proper WordPress capability checks (such as current_user_can()) before processing AJAX requests in both handlers, and consider moving these operations away from wp_ajax_nopriv_ hooks if they are not intended for unauthenticated use.

Patch guidance

Check the KingComposer plugin repository or vendor website for a security release addressing this issue. Update through the WordPress plugin administration panel once a patched version is available. Verify the updated version in the plugin details page post-update. As an interim mitigation, disable or deactivate the Premium Addons for KingComposer plugin if the custom sidebar functionality is not essential to your site's operation.

Detection guidance

Monitor WordPress logs for AJAX requests to endpoints matching add_custom_sidebar and remove_custom_sidebar originating from unauthenticated sessions. Check the octagon_custom_sidebar option in the WordPress options table for unexpected modifications using tools like WP-CLI (wp option get octagon_custom_sidebar). Review your site's widget assignments and custom sidebar configuration for unexplained changes. Consider enabling WordPress security logging plugins to capture AJAX activity if native logging is insufficient.

Why prioritize this

Although the CVSS score is MEDIUM (5.3), organizations using this plugin should patch promptly because custom sidebar manipulation is difficult to detect and can silently disrupt site presentation. The vulnerability is trivial to exploit at scale. Priority should increase if custom sidebars display revenue-generating or user-engagement content.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects low attack complexity, no authentication requirement, and network accessibility, balanced against the lack of confidentiality impact and limited scope (site integrity/availability rather than system-wide compromise). The vulnerability does not leak data or enable code execution, keeping severity in the MEDIUM range. However, the ease of exploitation and potential for widespread, coordinated attacks elevate practical risk beyond the base score.

Frequently asked questions