The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users. This vulnerability enables tampering with content created by [truncated]
ReviewNews Kit Addons for ElementorCVE published 2026-10-24
The News Kit Addons For Elementor WordPress plugin before 1.4.9 has a vulnerability allowing authenticated users with subscriber-level access and above to install and activate a specific plugin from the WordPress.org repository due to a missing capability check on one of its AJAX actions. This could lead to unauthorized changes in a WordPress environment. Defenders should assess exposure and prioritize ve [truncated]
