News Kit Addons For Elementor: Subscriber modification of arbitrary post metadata
The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users. This can be used to overwrite protected core metadata and tamper with content created by higher-privileged users. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: at most 1.4.7.
- Component
- News Kit Addons For Elementor
- Plugin slug
news-kit-elementor-addons- Affected
- <= 1.4.7
- Safe version
1.4.8- Published
- Oct 24, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Oct 24, 2026 and is one of 8 known issues for this plugin.
Update, patch or deactivate.
The official author notes confirm remediation in 1.4.8. The first matching fix is 1.4.8, but update to the checked current release 1.5.0 or a later supported release: another CVE in this batch is not fixed until 1.4.9. Official notes: https://wordpress.org/plugins/news-kit-elementor-addons/#developers. Enforce server-side caller, object and operation permissions at the disclosed trust boundary; do not treat knowledge of identifiers or a nonce as authorization.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users. This can be used to overwrite protected core metadata and tamper with content created by higher-privileged users.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L