{"id":"CVE-2026-97353","kind":"vulnerability","aliases":["CVE-2026-97353"],"related":[],"title":"News Kit Addons for Elementor: subscribers can overwrite any post's metadata","description":"The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users. This can be used to overwrite protected core metadata and tamper with content created by higher-privileged users.","summary":"The News Kit Addons For Elementor WordPress plugin through 1.4.7 has an authenticated AJAX action that updates post metadata without checking capability or ownership. A logged-in subscriber can write arbitrary meta keys on any post, including posts owned by other users and protected core metadata.","severity":"medium","cvss":null,"epss":0.0018,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","self-hosted","wordpress"],"not_affected_if":["auth-required","plugin-not-installed"],"how_to_check":"- Check whether the plugin is installed and its version is `1.4.7` or earlier, e.g. `wp plugin get news-kit-addons-for-elementor --field=version` (slug unknown from sources; confirm in the plugins list)\n- Confirm subscriber self-registration is enabled on the site (Settings > General > Membership)","fix":"- Update the News Kit Addons For Elementor plugin to a version later than `1.4.7` (fixed version unknown from sources)\n- Until updated, deactivate the plugin or disable open subscriber registration","status":"open","published_at":"2026-10-24T06:16:37+00:00","first_seen_at":"2026-10-24T06:47:03+00:00","triaged_at":"2026-10-25T04:51:47+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:51:47Z","model":"claude-haiku-5-5","output":{"fix":"- Update the News Kit Addons For Elementor plugin to a version later than `1.4.7` (fixed version unknown from sources)\n- Until updated, deactivate the plugin or disable open subscriber registration","reach":"internet","title":"News Kit Addons for Elementor: subscribers can overwrite any post's metadata","impact":"medium","summary":"The News Kit Addons For Elementor WordPress plugin through 1.4.7 has an authenticated AJAX action that updates post metadata without checking capability or ownership. A logged-in subscriber can write arbitrary meta keys on any post, including posts owned by other users and protected core metadata.","category":"package","nicknames":[],"who_cares":["wordpress","elementor","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Subscriber overwrites protected core metadata and tampers with other users' posts","analyst_note":"Find the fixed version and the NVD/WPScan advisory for the affected AJAX action name, and confirm the plugin slug.","how_to_check":"- Check whether the plugin is installed and its version is `1.4.7` or earlier, e.g. `wp plugin get news-kit-addons-for-elementor --field=version` (slug unknown from sources; confirm in the plugins list)\n- Confirm subscriber self-registration is enabled on the site (Settings > General > Membership)","needs_analyst":true,"not_affected_if":["plugin-not-installed","auth-required"],"who_is_affected":"Sites running the News Kit Addons For Elementor plugin at version 1.4.7 or earlier, where any account with subscriber-level access or higher can reach the vulnerable AJAX action. Exposure is greatest on sites that allow open registration, since anyone can create a subscriber account. Sites without this plugin, or with it already updated, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000671,"input_tokens":3353,"output_tokens":671,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-97353':15A,18A '1.4.7':34B,81C 'access':106C 'action':39B,99C 'addon':3A,28B,75C 'ajax':38B,98C 'allow':100C 'arbitrari':56B,111C 'attack':116C 'attacker-chosen':115C 'authent':37B,97C 'capabl':46B,85C 'check':45B,88C 'chosen':117C 'content':140C 'core':70B,135C 'creat':141C 'cve':13A,16A 'elementor':5A,19B,30B,77C 'higher':144C 'higher-privileg':143C 'host':23B 'includ':62B,122C 'key':58B,118C 'kit':2A,27B,74C 'level':105C 'log':51B 'logged-in':50B 'meta':57B,113C 'metadata':12A,43B,71B,92C,136C 'news':1A,26B,73C 'one':94C 'overwrit':8A,133C 'own':64B,124C 'ownership':48B,87C 'packag':20B 'perform':84C 'plugin':32B,79C 'post':10A,42B,61B,63B,91C,112C,121C 'privileg':145C 'protect':69B,134C 'self':22B 'self-host':21B 'subscrib':6A,53B,104C 'subscriber-level':103C 'tamper':138C 'updat':41B,90C 'use':131C 'user':67B,101C,127C,146C 'without':44B 'wordpress':24B,31B,78C 'write':55B,110C","nicknames":[],"mitigations":[],"who_affected":"Sites running the News Kit Addons For Elementor plugin at version 1.4.7 or earlier, where any account with subscriber-level access or higher can reach the vulnerable AJAX action. Exposure is greatest on sites that allow open registration, since anyone can create a subscriber account. Sites without this plugin, or with it already updated, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T06:16:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97353","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97353","severity":null,"published_at":"2026-10-24T06:16:37+00:00","modified_at":"2026-10-24T06:16:37+00:00","first_seen_at":"2026-10-24T06:47:03+00:00","fetched_at":"2026-10-24T06:47:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-97353","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97353","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}