CVE-2026-97353 Details
Description
The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users. This can be used to overwrite protected core metadata and tamper with content created by higher-privileged users.
A vulnerability exists in the News Kit Addons For Elementor WordPress plugin, affecting versions through 1.4.7. The issue arises because the plugin's authenticated AJAX action, nekit_update_mega_menu_form, does not implement proper capability or ownership checks before modifying post metadata. This oversight enables users with subscriber-level access and higher to inject arbitrary post meta under chosen keys to any post, including those owned by others. Exploitation of this vulnerability could lead to overwriting protected core metadata and manipulation of content created by users with higher privileges.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 24, 2026CISA-ADP
Assessed Oct 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/4114e6a4-d8ed-4456-a15f-4d47034ae75f/ | [email protected] | AdvisoryExploitPartial Content |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| News Kit Addons | <= 1.4.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 24, 2026 | CVE Modified | CISA-ADP |
| Oct 24, 2026 | New CVE Received | [email protected] |