CVE-2026-117487 in Flatsome Plugin
Summary
by MITRE • 11/14/2026
The Flatsome WordPress theme before 3.20.13 does not perform a capability or nonce check on an AJAX action available to unauthenticated users, and does not restrict the status of the posts it returns by ID, allowing unauthenticated users to disclose the content of unpublished (draft and pending) posts.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/14/2026
The vulnerability identified in Flatsome WordPress theme versions prior to 3.20.13 represents a critical failure in access control mechanisms within an AJAX endpoint designed for dynamic content loading. This flaw stems from insufficient validation of user permissions and the absence of cryptographic verification tokens, commonly known as nonces, which are standard practice in secure web application development to prevent unauthorized state changes or data retrieval. By failing to enforce capability checks, the theme allows any individual with internet access, regardless of authentication status, to interact directly with server-side functions intended for authenticated administrators or specific user roles. This lack of restriction fundamentally undermines the security model of the WordPress platform, which relies on role-based access control to segregate administrative tasks from public-facing interactions.
From a technical perspective, the core issue lies in how the AJAX action processes requests based solely on post identifiers without verifying if the requester has legitimate rights to view that specific content. In standard secure implementations, an application must verify both that the user is authenticated and possesses the necessary privileges for the requested operation, as well as validate nonces to ensure the request originated from a trusted source within the expected session context. The absence of these checks means that malicious actors can craft simple HTTP requests containing arbitrary post IDs to trigger the vulnerable endpoint. Because the logic does not filter results by publication status, such as draft or pending states, the system returns full content metadata and body text for posts that are explicitly intended to remain hidden from public view during their development phase.
The operational impact of this vulnerability is significant, particularly for websites where sensitive information might be stored in unpublished drafts before final review and publication. Attackers can exploit this flaw to perform unauthorized data disclosure, effectively bypassing the editorial workflow controls inherent to content management systems. This could lead to the exposure of proprietary business strategies, personal identifiable information, or other confidential materials that were never meant for public consumption. Furthermore, because the vulnerability affects unauthenticated users, it requires no prior login credentials, making it highly exploitable and scalable across large numbers of vulnerable installations without significant effort from the attacker.
This incident aligns with Common Weakness Enumeration (CWE) standards, specifically mapping to CWE-284 Improper Access Control and CWE-359 Exposure of Private Information. The exploitation technique corresponds to ATT&CK tactic TA0001 Initial Access or TA0007 Discovery, depending on the attacker's intent, as it involves enumerating internal content structures through unauthorized API calls. To mitigate this risk, site administrators must immediately update the Flatsome theme to version 3.20.13 or later, where these access control checks have been implemented. Additionally, implementing a Web Application Firewall (WAF) can provide an additional layer of defense by monitoring and blocking suspicious AJAX patterns associated with unauthenticated enumeration attempts until patches are fully deployed across all affected environments.