Missing Authorization in News Element Elementor Blog Magazine Plugin for WordPress

CVE-2026-2284

What is CVE-2026-2284?

The News Element Elementor Blog Magazine plugin for WordPress contains a significant security flaw due to a missing capability check and nonce verification on the 'ne_clean_data' AJAX action. This allows authenticated users with Subscriber-level permissions and higher to exploit the vulnerability. Attackers can truncate critical database tables, including posts, comments, and meta information, as well as delete the entire WordPress uploads directory, leading to severe data loss. All versions of the plugin up to and including 1.0.8 are affected, making it crucial for users to update and enforce proper access controls.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References