Missing Authorization in King Addons Image Optimizer AJAX Actions

The Image Optimizer AJAX handlers in King Addons for Elementor accepted an attachment ID from the request and acted on it without checking that the requesting user was allowed to edit that attachment. Any authenticated user who could reach these actions could optimize, restore, skip or read the optimization data of media owned by other users, and... Weiterlesen