CVE-2026-117490 · Package
NO FIX YET · SEE WHAT TO DO
The Flatsome WordPress theme before 3.20.13 fails to check a user's publish and post-type permissions on an AJAX save action. A logged-in Contributor can publish their own content and change its post type, for example to a product, without the rights normally required.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Flatsome theme below 3.20.13 that have users with the Contributor role or higher. Sites without Flatsome, or with it updated, are not affected. The sources do not say whether the flaw is reachable without an account.
Not affected if flatsome-3.20.13-or-later, no-contributor-accounts
Who cares flatsome, self-hosted, wordpress
3.20.13 are affected; move to 3.20.13 or later (per the NVD description).The Flatsome WordPress theme before 3.20.13 does not enforce the acting user's publish and post-type restrictions on an AJAX save action, allowing users with a role as low as Contributor to publish their own content and change its post type (for example to a product) without holding the required capabilities.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.