CVE-2026-97353 News Kit Addons For Elementor CVE debrief

Who should care

WordPress administrators and security teams should assess exposure and prioritize remediation for installations using the News Kit Addons For Elementor plugin version 1.4.7 or earlier.

Why it matters

The CVE-2026-97353 vulnerability allows users with subscriber-level access and above to write arbitrary post meta to any post, including those owned by other users. This can be used to tamper with content created by higher-privileged users and overwrite protected core metadata. WordPress administrators and security teams should assess exposure and prioritize remediation for installations using the News Kit Addons For Elementor plugin version 1.4.7 or earlier.

• Tampering with content created by higher-privileged users
• Overwriting protected core metadata
• Potential for unauthorized post metadata updates

Technical summary

The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users. This vulnerability enables tampering with content created by higher-privileged users and overwriting protected core metadata. The affected product is the News Kit Addons For Elementor WordPress plugin, and the vulnerability class is improper access control.

Defensive priority

Assess exposure and prioritize remediation for WordPress installations using the News Kit Addons For Elementor plugin version 1.4.7 or earlier.

Recommended defensive actions

• Assess exposure by checking WordPress installations for the News Kit Addons For Elementor plugin version 1.4.7 or earlier
• Prioritize remediation for high-risk WordPress installations
• Monitor for suspicious post metadata updates
• Verify plugin version and update to a patched version if available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation is required to determine the full scope of affected systems and potential impact. The vulnerability allows users with subscriber-level access and above to write arbitrary post meta to any post, including those owned by other users. This can be used to tamper with content created by higher-privileged users and overwrite protected core metadata. The News Kit Addons For Elementor WordPress plugin through 1.4.7 is affected, and WordPres

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.