CVE-2026-97352: News Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via nekit_install_importer

Q: Which users can exploit this issue?

Any authenticated user with subscriber-level access or higher can invoke the affected AJAX action. Unauthenticated visitors are not described as able to exploit it.

Q: What can an attacker do through the vulnerable action?

They can install and activate a specific plugin from the WordPress.org repository. The available data does not identify which plugin is installed.

Q: Are installations running version 1.4.9 affected?

No. The issue affects versions before 1.4.9, so updating to 1.4.9 or later addresses the described missing capability check.

Published Oct 24, 2026

Updated

The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor WordPress plugin before 1.4.9 from the WordPress.org repository.

Affected Software

1 affected component

News Kit Addons For Elementor<1.4.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade News Kit Addons For Elementor to a version that resolves this vulnerability.
Fixed in 1.4.9

Event History

Oct 24, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

Any authenticated user with subscriber-level access or higher can invoke the affected AJAX action. Unauthenticated visitors are not described as able to exploit it.

What can an attacker do through the vulnerable action?

They can install and activate a specific plugin from the WordPress.org repository. The available data does not identify which plugin is installed.

Are installations running version 1.4.9 affected?