News Kit Addons CVE-2026-97353

Requires a valid authenticated account at subscriber level or above (PR:L) on a WordPress site running News Kit Addons For Elementor version ≤1.4.7; no non-default configuration is indicated, as the vulnerable authenticated AJAX action is reachable by any registered user. The practical limiting factor is account access: exploitation presupposes that user registration is open (or the attacker otherwise obtains a low-privilege account), after which no further capability or ownership check gates the write. The specific AJAX action name and parameter format are not stated in the available sources.

This is a genuine but moderate-priority issue, not a top-tier emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, score 5.4) describes a remotely reachable, low-complexity flaw that requires authentication (PR:L) - consistent with the description's 'subscriber-level access and above' and with CWE-862 (Missing Authorization). The signals align toward low real-world urgency: EPSS is only 0.18% (7th percentile), the CVE is NOT in CISA KEV, and the exploit reference is a WPScan advisory, not verified working exploit code. The vuln.today decision label is 'this_month', i.e. schedule remediation but not act_now/emergency. The one point of friction is the broad integrity wording - 'arbitrary post meta under attacker-chosen keys to any post, including protected core metadata' - which is a wider integrity impact than a bare I:L suggests, though it remains confined to post metadata rather than full site takeover; I treat that as a signal to prioritise above a trivial info-leak but not as evidence of critical impact. Also note: the input's A:L (availability) is not substantiated by the description, which describes tampering/overwrite (integrity), not disruption. Net: a real, easily-triggered access-control flaw gated behind having any registered account, low observed exploitation interest.

An attacker registers or already holds a subscriber-level account on a WordPress site running News Kit Addons For Elementor (≤1.4.7) and sends a crafted request to the plugin's authenticated AJAX metadata-update action, which performs no capability or ownership check. They write attacker-chosen post meta keys onto posts owned by higher-privileged users, overwriting protected core metadata to tamper with that content. A public PoC reference exists (WPScan); it is not verified as working exploit code, and the low attack complexity (AC:L) means triggering is trivial once authenticated.