---
id: "CVE-2026-97353"
kind: "vulnerability"
aliases: ["CVE-2026-97353"]
title: "News Kit Addons for Elementor: subscribers can overwrite any post's metadata"
severity: "medium"
cvss: null
epss: 0.0018
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elementor", "package", "self-hosted", "wordpress"]
not_affected_if: ["auth-required", "plugin-not-installed"]
published_at: "2026-10-24T06:16:37+00:00"
first_seen_at: "2026-10-24T06:47:03+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97353", "first_seen_at": "2026-10-24T06:47:03+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-97353", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# News Kit Addons for Elementor: subscribers can overwrite any post's metadata

The News Kit Addons For Elementor WordPress plugin through 1.4.7 has an authenticated AJAX action that updates post metadata without checking capability or ownership. A logged-in subscriber can write arbitrary meta keys on any post, including posts owned by other users and protected core metadata.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the plugin is installed and its version is `1.4.7` or earlier, e.g. `wp plugin get news-kit-addons-for-elementor --field=version` (slug unknown from sources; confirm in the plugins list)
- Confirm subscriber self-registration is enabled on the site (Settings > General > Membership)

## Fix

- Update the News Kit Addons For Elementor plugin to a version later than `1.4.7` (fixed version unknown from sources)
- Until updated, deactivate the plugin or disable open subscriber registration

## Timeline

- 2026-10-24T06:47:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97353
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-97353

## From the sources

The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users. This can be used to overwrite protected core metadata and tamper with content created by higher-privileged users.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_