CVE-2026-97353

Name of the Vulnerable Software and Affected Versions News Kit Addons For Elementor WordPress plugin versions prior to 1.4.8

Description An authenticated AJAX action fails to perform capability or ownership checks before updating post metadata. This allows users with subscriber-level access and above to write arbitrary post meta under attacker-chosen keys to any post, including those owned by other users. This flaw can be used to overwrite protected core metadata and tamper with content created by higher-privileged users. Real-world offensive activities targeting this issue have been identified.

Recommendations Update News Kit Addons For Elementor WordPress plugin to version 1.4.8 or later.