Authorization Flaw in News Kit Addons for Elementor WordPress Plugin
CVE-2026-97353
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 24 October 2026
Badges
What is CVE-2026-97353?
The News Kit Addons For Elementor WordPress plugin, up to version 1.4.7, has a serious authorization flaw that fails to perform essential capability and ownership checks during an authenticated AJAX action. This vulnerability enables users with as little as subscriber-level access to modify post metadata arbitrarily. Attackers can exploit this flaw to write their own keys and overwrite protected core metadata, potentially manipulating content associated with higher-privileged users’ posts. This poses a significant security risk as it allows for unauthorized changes to existing content and can impact the integrity of the WordPress site.
Affected Version(s)
News Kit Addons For Elementor 0 <= 1.4.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.