CVE-2026-117487 · Package
NO FIX YET · SEE WHAT TO DO
The Flatsome WordPress theme exposes an AJAX action to logged-out visitors without a capability or nonce check. Anyone can request draft and pending posts by ID and read their content.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Flatsome WordPress theme before 3.20.13. The exposure is the unauthenticated AJAX action, so any site with the vulnerable theme version is reachable from the internet without an account. unknown whether sites with unusual configurations are affected differently.
Not affected if theme-version-3.20.13-or-later
Who cares flatsome, self-hosted, wordpress
3.20.13 or later (the fixed version named in the sources).The Flatsome WordPress theme before 3.20.13 does not perform a capability or nonce check on an AJAX action available to unauthenticated users, and does not restrict the status of the posts it returns by ID, allowing unauthenticated users to disclose the content of unpublished (draft and pending) posts.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.