{"id":"CVE-2026-117487","kind":"vulnerability","aliases":["CVE-2026-117487"],"related":[],"title":"Flatsome WordPress theme: unauthenticated users can read unpublished draft posts","description":"The Flatsome WordPress theme before 3.20.13 does not perform a capability or nonce check on an AJAX action available to unauthenticated users, and does not restrict the status of the posts it returns by ID, allowing unauthenticated users to disclose the content of unpublished (draft and pending) posts.","summary":"The Flatsome WordPress theme exposes an AJAX action to logged-out visitors without a capability or nonce check. Anyone can request draft and pending posts by ID and read their content.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["flatsome","package","self-hosted","wordpress"],"not_affected_if":["theme-version-3.20.13-or-later"],"how_to_check":"- Check the installed Flatsome theme version in the WordPress admin under Appearance > Themes, or in the theme's style.css header.\n- Confirm whether the site uses the Flatsome theme at all.","fix":"- Flatsome: move to version `3.20.13` or later (the fixed version named in the sources).","status":"open","published_at":"2026-11-14T07:17:17+00:00","first_seen_at":"2026-11-14T07:27:45+00:00","triaged_at":"2026-11-14T07:28:20+00:00","updated_at":"2026-11-14T07:28:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-14T07:28:20Z","model":"claude-haiku-5-5","output":{"fix":"- Flatsome: move to version `3.20.13` or later (the fixed version named in the sources).","reach":"internet","title":"Flatsome WordPress theme: unauthenticated users can read unpublished draft posts","impact":"low","summary":"The Flatsome WordPress theme exposes an AJAX action to logged-out visitors without a capability or nonce check. Anyone can request draft and pending posts by ID and read their content.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","flatsome","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"unpublished draft and pending post content readable by anyone","analyst_note":"","how_to_check":"- Check the installed Flatsome theme version in the WordPress admin under Appearance > Themes, or in the theme's style.css header.\n- Confirm whether the site uses the Flatsome theme at all.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["theme-version-3.20.13-or-later"],"who_is_affected":"Sites running the Flatsome WordPress theme before 3.20.13. The exposure is the unauthenticated AJAX action, so any site with the vulnerable theme version is reachable from the internet without an account. unknown whether sites with unusual configurations are affected differently.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000706,"input_tokens":4548,"output_tokens":503,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117487':13A,16A '-2026':12A,15A '3.20.13':60C 'action':30B,72C 'ajax':29B,71C 'allow':90C 'anyon':42B 'avail':73C 'capabl':38B,65C 'check':41B,68C 'content':54B,96C 'cve':11A,14A 'disclos':94C 'draft':9A,45B,99C 'expos':27B 'flatsom':1A,17B,24B,56C 'host':21B 'id':50B,89C 'log':33B 'logged-out':32B 'nonc':40B,67C 'packag':18B 'pend':47B,101C 'perform':63C 'post':10A,48B,85C,102C 'read':7A,52B 'request':44B 'restrict':80C 'return':87C 'self':20B 'self-host':19B 'status':82C 'theme':3A,26B,58C 'unauthent':4A,75C,91C 'unpublish':8A,98C 'user':5A,76C,92C 'visitor':35B 'without':36B 'wordpress':2A,22B,25B,57C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Flatsome WordPress theme before 3.20.13. The exposure is the unauthenticated AJAX action, so any site with the vulnerable theme version is reachable from the internet without an account. unknown whether sites with unusual configurations are affected differently.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["flatsome","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-117487':13A,16A '-2026':12A,15A 'cve':11A,14A 'draft':9A 'flatsom':1A 'post':10A 'read':7A 'theme':3A 'unauthent':4A 'unpublish':8A 'user':5A 'wordpress':2A","search_b":"'action':30B 'ajax':29B 'anyon':42B 'capabl':38B 'check':41B 'content':54B 'draft':45B 'expos':27B 'flatsom':17B,24B 'host':21B 'id':50B 'log':33B 'logged-out':32B 'nonc':40B 'packag':18B 'pend':47B 'post':48B 'read':52B 'request':44B 'self':20B 'self-host':19B 'theme':26B 'visitor':35B 'without':36B 'wordpress':22B,25B","search_c":"'3.20.13':60C 'action':72C 'ajax':71C 'allow':90C 'avail':73C 'capabl':65C 'check':68C 'content':96C 'disclos':94C 'draft':99C 'flatsom':56C 'id':89C 'nonc':67C 'pend':101C 'perform':63C 'post':85C,102C 'restrict':80C 'return':87C 'status':82C 'theme':58C 'unauthent':75C,91C 'unpublish':98C 'user':76C,92C 'wordpress':57C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T07:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117487","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117487","severity":null,"published_at":"2026-11-14T07:17:17+00:00","modified_at":"2026-11-14T07:17:17+00:00","first_seen_at":"2026-11-14T07:27:45+00:00","fetched_at":"2026-11-14T07:27:45+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}