◆ CVE Hub

CVE-2026-97353

SSVC: none

News Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_update_mega_menu_form

Published
2026-10-24
Last modified
2026-10-24
CNA
WPScan
NVD status
Received
CWE
CWE-862

Fetching some sources has been requested. Reload in about a minute to see them.

CVSS v3.1 (listed by NVD)
5.4
MEDIUM
Scored by CISA-ADP (not yet scored by NVD)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
—
Not scored
EPSS exploit probability
0.2%
Percentile 7.2%
as of 2026-10-24
CISA KEV
—
Not listed
SSVC (CISA ADP)
none
Automatable: no / Impact: partial

Attack conditions and impact

Derived from the CISA-ADP (via NVD) CVSS 3.1 vector
NetworkLoginNo interaction Confidentiality NIntegrity LAvailability L
MetricValueMeaning
Attack vector AVNNetwork
Attack complexity ACLLow (easy)
Privileges required PRLRegular user
User interaction UINNone
Scope SUUnchanged
Confidentiality CNNone
Integrity ILLow
Availability ALLow
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Description

NVD

The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users. This can be used to overwrite protected core metadata and tamper with content created by higher-privileged users.

CVSS assessments

ProviderVersionScoreVector
NVD / 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)3.15.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
ADP / CISA-ADP3.15.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Affected products and packages

CNA (CVE.org)

VendorProductVersions
UnknownNews Kit Addons For Elementor
affected: 0 … <= 1.4.7
default: unknown

Linux distribution status

Red Hat ↗ Fetching

Debian ↗

No record

Ubuntu ↗ Fetching

References (1)