CVE-2026-117487: Flatsome < 3.20.13 - Unauthenticated Unpublished Post Disclosure via flatsome_ajax_apply_shortcode
The Flatsome WordPress theme before 3.20.13 does not perform a capability or nonce check on an AJAX action available to unauthenticated users, and does not restrict the status of the posts it returns by ID, allowing unauthenticated users to disclose the content of unpublished (draft and pending) posts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.20.13
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites using a Flatsome theme version earlier than 3.20.13 are exposed if the vulnerable AJAX action is available. An attacker does not need to authenticate to request content from draft or pending posts.
What content can an attacker obtain?
The issue allows disclosure of the content of unpublished posts whose status is draft or pending. The affected action returns posts by ID without restricting their publication status.
Does exploitation require a WordPress account or user interaction?
No. The affected AJAX action is available to unauthenticated users, and the missing capability and nonce checks mean an attacker does not need an account or a valid request token.
How can I determine whether my site may be affected?
Check the installed Flatsome theme version. Versions before 3.20.13 may be affected, particularly if the site contains draft or pending posts whose contents must remain private.