Authorization Bypass in Flatsome WordPress Theme by UX Themes
CVE-2026-117490
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-117490?
The Flatsome WordPress theme prior to version 3.20.13 is susceptible to an authorization bypass vulnerability. This flaw allows users with minimal permissions, such as Contributors, to publish their own content and modify its post type to something different, like a product. The lack of enforcement on the user's publish and post-type restrictions during AJAX save actions poses a significant risk, as it could enable unauthorized access to content management functionalities.
Affected Version(s)
Flatsome 0 < 3.20.13
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.