CVE-2026-97353: News Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_update_mega_menu_form
The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users. This can be used to overwrite protected core metadata and tamper with content created by higher-privileged users.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with subscriber-level access or higher can exploit the affected AJAX action. The attacker does not need to own the target post and can target posts created by higher-privileged users.
What can an attacker change?
An attacker can write arbitrary post metadata under attacker-chosen keys to any post. This includes the ability to overwrite protected core metadata and tamper with content associated with other users' posts.
Are sites with only trusted administrator accounts exposed?
Exploitation requires an authenticated account at subscriber level or above. Sites that do not permit untrusted users to obtain or use such accounts have a reduced exposure, though any compromised qualifying account could still be used.
What temporary mitigation is available if updating is not immediately possible?
Restrict or remove subscriber-and-higher accounts that are not trusted, and limit access to the affected plugin's authenticated AJAX functionality where operationally possible. Review post metadata for unauthorized changes, particularly on posts owned by higher-privileged users.