{"id":"CVE-2026-117490","kind":"vulnerability","aliases":["CVE-2026-117490"],"related":[],"title":"Flatsome WordPress theme: contributors can publish content without permission","description":"The Flatsome WordPress theme before 3.20.13 does not enforce the acting user's publish and post-type restrictions on an AJAX save action, allowing users with a role as low as Contributor to publish their own content and change its post type (for example to a product) without holding the required capabilities.","summary":"The Flatsome WordPress theme before 3.20.13 fails to check a user's publish and post-type permissions on an AJAX save action. A logged-in Contributor can publish their own content and change its post type, for example to a product, without the rights normally required.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["flatsome","package","self-hosted","wordpress"],"not_affected_if":["flatsome-3.20.13-or-later","no-contributor-accounts"],"how_to_check":"- Check the installed Flatsome version in the theme's style.css header or Appearance > Themes in the WordPress admin.\n- Confirm whether the site allows Contributor accounts that others can register or use.","fix":"- Flatsome versions before `3.20.13` are affected; move to `3.20.13` or later (per the NVD description).","status":"open","published_at":"2026-11-14T07:17:18+00:00","first_seen_at":"2026-11-14T07:27:45+00:00","triaged_at":"2026-11-14T07:28:17+00:00","updated_at":"2026-11-14T07:28:17+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-14T07:28:17Z","model":"claude-haiku-5-5","output":{"fix":"- Flatsome versions before `3.20.13` are affected; move to `3.20.13` or later (per the NVD description).","reach":"network","title":"Flatsome WordPress theme: contributors can publish content without permission","impact":"low","summary":"The Flatsome WordPress theme before 3.20.13 fails to check a user's publish and post-type permissions on an AJAX save action. A logged-in Contributor can publish their own content and change its post type, for example to a product, without the rights normally required.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","flatsome","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Contributor users publish content and change post types without permission","analyst_note":"","how_to_check":"- Check the installed Flatsome version in the theme's style.css header or Appearance > Themes in the WordPress admin.\n- Confirm whether the site allows Contributor accounts that others can register or use.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["flatsome-3.20.13-or-later","no-contributor-accounts"],"who_is_affected":"Sites running the Flatsome theme below 3.20.13 that have users with the Contributor role or higher. Sites without Flatsome, or with it updated, are not affected. The sources do not say whether the flaw is reachable without an account.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000714,"input_tokens":4541,"output_tokens":519,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117490':12A,15A '-2026':11A,14A '3.20.13':27B,75C 'act':80C 'action':44B,93C 'ajax':42B,91C 'allow':94C 'capabl':122C 'chang':56B,109C 'check':30B 'content':7A,54B,107C 'contributor':4A,49B,102C 'cve':10A,13A 'enforc':78C 'exampl':61B,114C 'fail':28B 'flatsom':1A,16B,23B,71C 'hold':119C 'host':20B 'log':47B 'logged-in':46B 'low':100C 'normal':68B 'packag':17B 'permiss':9A,39B 'post':37B,58B,86C,111C 'post-typ':36B,85C 'product':64B,117C 'publish':6A,34B,51B,83C,104C 'requir':69B,121C 'restrict':88C 'right':67B 'role':98C 'save':43B,92C 'self':19B 'self-host':18B 'theme':3A,25B,73C 'type':38B,59B,87C,112C 'user':32B,81C,95C 'without':8A,65B,118C 'wordpress':2A,21B,24B,72C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Flatsome theme below 3.20.13 that have users with the Contributor role or higher. Sites without Flatsome, or with it updated, are not affected. The sources do not say whether the flaw is reachable without an account.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["flatsome","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-117490':12A,15A '-2026':11A,14A 'content':7A 'contributor':4A 'cve':10A,13A 'flatsom':1A 'permiss':9A 'publish':6A 'theme':3A 'without':8A 'wordpress':2A","search_b":"'3.20.13':27B 'action':44B 'ajax':42B 'chang':56B 'check':30B 'content':54B 'contributor':49B 'exampl':61B 'fail':28B 'flatsom':16B,23B 'host':20B 'log':47B 'logged-in':46B 'normal':68B 'packag':17B 'permiss':39B 'post':37B,58B 'post-typ':36B 'product':64B 'publish':34B,51B 'requir':69B 'right':67B 'save':43B 'self':19B 'self-host':18B 'theme':25B 'type':38B,59B 'user':32B 'without':65B 'wordpress':21B,24B","search_c":"'3.20.13':75C 'act':80C 'action':93C 'ajax':91C 'allow':94C 'capabl':122C 'chang':109C 'content':107C 'contributor':102C 'enforc':78C 'exampl':114C 'flatsom':71C 'hold':119C 'low':100C 'post':86C,111C 'post-typ':85C 'product':117C 'publish':83C,104C 'requir':121C 'restrict':88C 'role':98C 'save':92C 'theme':73C 'type':87C,112C 'user':81C,95C 'without':118C 'wordpress':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T07:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117490","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117490","severity":null,"published_at":"2026-11-14T07:17:18+00:00","modified_at":"2026-11-14T07:17:18+00:00","first_seen_at":"2026-11-14T07:27:45+00:00","fetched_at":"2026-11-14T07:27:45+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}