King Addons for Elementor Unauthenticated API Key Disclosure Vulnerability

A vulnerability exists in the King Addons for Elementor plugin for WordPress, affecting all versions up to and including 51.1.49. The issue arises from the plugin's 'render_full_form' function, which inadvertently exposes API keys for Mailchimp, Facebook, and Google in the HTML source code. This flaw allows unauthenticated attackers to extract these sensitive keys and secrets. Notably, the vulnerability requires the Premium license to be active.

Impact

Exploitation of this vulnerability leads to the unauthorized disclosure of API keys and secrets for Mailchimp, Facebook, and Google, potentially allowing attackers to misuse these credentials.

Remediation

Users can update to version 51.1.51 or a newer patched version to address this vulnerability.