CVE-2026-97353: CWE-862 Missing Authorization in News Kit Addons For Elementor
Description
The News Kit Addons For Elementor WordPress plugin up to version 1.4.7 contains a missing authorization vulnerability. It fails to verify user capabilities or ownership before allowing updates to post metadata via an authenticated AJAX action. This flaw permits users with subscriber-level access or higher to write arbitrary metadata to any post, including those owned by other users. Attackers can overwrite protected core metadata and manipulate content created by users with higher privileges.
Affected software
News Kit Addons For Elementor
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-97353 is a missing authorization vulnerability (CWE-862) in the News Kit Addons For Elementor WordPress plugin versions up to 1.4.7. The plugin does not perform proper capability or ownership checks before updating post metadata in an authenticated AJAX action. This allows authenticated users with subscriber-level access or above to write arbitrary post meta under attacker-chosen keys to any post, including posts owned by other users. This can lead to overwriting protected core metadata and tampering with content created by higher-privileged users.
Potential Impact
Authenticated users with low privileges (subscriber-level and above) can modify post metadata for any post, including those owned by other users. This can result in unauthorized content tampering and potential disruption of site integrity by overwriting protected core metadata.
Mitigation Recommendations
No official patch or fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict user roles to trusted users only and monitor for suspicious activity related to post metadata changes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-24T12:36:02.671Z
- State
- PUBLISHED
Threat ID: 6adc4e27d73cc49347e47224
Added to database: 10/24/2026, 06:20:23 UTC
Last enriched: 10/24/2026, 06:35:07 UTC
Last updated: 10/24/2026, 06:35:33 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.