Live › vulnerability › CVE-2026-97353
Go to dashboardThe News Kit Addons For Elementor WordPress plugin through 1.4.7 has an authenticated AJAX action that updates post metadata without checking capability or ownership. A logged-in subscriber can write arbitrary meta keys on any post, including posts owned by other users and protected core metadata.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 06:47 UTC. All times on this page are UTC.
Sites running the News Kit Addons For Elementor plugin at version 1.4.7 or earlier, where any account with subscriber-level access or higher can reach the vulnerable AJAX action. Exposure is greatest on sites that allow open registration, since anyone can create a subscriber account. Sites without this plugin, or with it already updated, can skip it.
No product ranges from the sources yet.
1.4.7 or earlier, e.g. wp plugin get news-kit-addons-for-elementor --field=version (slug unknown from sources; confirm in the plugins list)1.4.7 (fixed version unknown from sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users. This can be used to overwrite protected core metadata and tamper with content created by higher-privileged users.
This page as .md · .json · in your agent: get_signal("CVE-2026-97353")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.