News Kit Addons CVE-2026-97352

Exploitation requires an authenticated WordPress account at subscriber level or above on a site running News Kit Addons For Elementor before version 1.4.9; the specific vulnerable AJAX action lacks a capability check, so any such logged-in user can invoke it. The practical limiting factor is this authentication requirement (PR:L): the attacker must already have a valid low-privilege account, which is trivial on sites allowing open user registration but a real barrier on sites that do not. No user interaction from an administrator is needed (UI:N), and no non-default plugin configuration is described as a prerequisite. Impact is bounded by the described action - installing and activating a plugin from the WordPress.org repository - rather than arbitrary file upload.

This is a genuinely low-to-moderate priority issue despite being network-reachable. The CVSS 3.1 base score is 4.3 (Medium), and the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N shows the real limiters: exploitation requires an authenticated account (PR:L) and yields only a low integrity impact (I:L) with no confidentiality or availability loss. The signals are mutually consistent rather than conflicting: EPSS is low at 0.18% (7th percentile), the CVE is NOT on the CISA KEV list, and only a non-verified PoC reference exists - none of which point to active or widespread exploitation. The vuln.today decision label is 'this_month', not act_now or emergency, aligning with the low urgency. The main caveat is the capped impact rating: because the flaw lets a low-privileged user install and activate arbitrary-looking plugin content via a missing capability check, defenders should confirm whether the AJAX action can be abused beyond the single repository plugin the description names, since broader plugin-installation capability would materially raise integrity (and potentially lead to RCE) beyond the I:L the vector assumes. As described, however, the action is scoped to installing/activating a specific WordPress.org plugin, so I:L is defensible. Vendor identity is marked 'unknown' in the CPE, which slightly reduces confidence in attribution but not in the technical facts, which come from WPScan.

An attacker registers or obtains a low-privilege subscriber account on a WordPress site running News Kit Addons For Elementor before 1.4.9 - self-registration is common on many sites. Because the vulnerable AJAX action performs no capability check, the authenticated subscriber invokes it to install and activate a plugin from the WordPress.org repository, an action that should be restricted to administrators. A public PoC reference exists but is not verified as working exploit code.