PT-2026-147369

CVE-2026-117487

·

Published

2026-11-14

·

Updated

2026-11-14

Description by

Score
N/A
Not available

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

Name of the Vulnerable Software and Affected Versions Flatsome versions prior to 3.20.13
Description An issue exists where the software fails to perform a capability or nonce check on an AJAX action available to unauthenticated users. Additionally, it does not restrict the status of posts returned by ID, which allows unauthenticated users to disclose the content of unpublished posts, such as those in draft or pending status, via the flatsome ajax apply shortcode action.
Recommendations Update to version 3.20.13 or later.
Exploitability
Exploit
Researchers
Vendors
Affected products
Related identifiers
CVE-2026-117487
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com