Exposed AJAX Action in Flatsome Theme Allows Disclosure of Unpublished Content
CVE-2026-117487
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-117487?
The Flatsome WordPress theme, prior to version 3.20.13, is vulnerable due to a lack of necessary capability or nonce checks on a specific AJAX action accessible to users without authentication. This oversight permits these unauthenticated users to retrieve unpublished content, including drafts and posts in pending status, by their ID, potentially exposing sensitive information that should remain confidential. Implementing proper checks and restrictions is essential to mitigate the risk of content disclosure.
Affected Version(s)
Flatsome 0 < 3.20.13
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.