CVE-2026-97353 News Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_update_mega_menu_form
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-97353?
CVE-2026-97353 is a medium-severity vulnerability in Unknown News Kit Addons For Elementor, published on 24 Oct 2026.
Official description
The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users. This can be used to overwrite protected core metadata and tamper with content created by higher-privileged users.
Weakness: CWE-862
Which versions are affected by CVE-2026-97353?
How do I fix CVE-2026-97353?
No fix has been published for CVE-2026-97353 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-97353 being exploited?
There is no known exploitation of CVE-2026-97353 in the wild and no public exploit code.
Sources
Also known as GHSA-qw4x-6r3w-q94x.