---
id: "CVE-2026-117487"
page: "https://infrastack.ai/live/CVE-2026-117487"
kind: "vulnerability"
aliases: ["CVE-2026-117487"]
title: "Flatsome WordPress theme: unauthenticated users can read unpublished draft posts"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["flatsome", "package", "self-hosted", "wordpress"]
not_affected_if: ["theme-version-3.20.13-or-later"]
published_at: "2026-11-14T07:17:17+00:00"
first_seen_at: "2026-11-14T07:27:45+00:00"
updated_at: "2026-11-14T07:28:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117487", "first_seen_at": "2026-11-14T07:27:45+00:00"}]
exploit_sources: []
---

# Flatsome WordPress theme: unauthenticated users can read unpublished draft posts

Link for people: https://infrastack.ai/live/CVE-2026-117487 (this .md is for agents)

The Flatsome WordPress theme exposes an AJAX action to logged-out visitors without a capability or nonce check. Anyone can request draft and pending posts by ID and read their content.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Flatsome theme version in the WordPress admin under Appearance > Themes, or in the theme's style.css header.
- Confirm whether the site uses the Flatsome theme at all.

## Fix

- Flatsome: move to version `3.20.13` or later (the fixed version named in the sources).

## Timeline

- 2026-11-14T07:27:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117487

## From the sources

The Flatsome WordPress theme before 3.20.13 does not perform a capability or nonce check on an AJAX action available to unauthenticated users, and does not restrict the status of the posts it returns by ID, allowing unauthenticated users to disclose the content of unpublished (draft and pending) posts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_