CVE-2026-117487
Received Received - Intake

Unauthenticated Post Content Disclosure in Flatsome Theme

Publication date: 2026-11-14

Last updated on: 2026-11-14

Assigner: WPScan

Description
The Flatsome WordPress theme before 3.20.13 does not perform a capability or nonce check on an AJAX action available to unauthenticated users, and does not restrict the status of the posts it returns by ID, allowing unauthenticated users to disclose the content of unpublished (draft and pending) posts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-14
Last Modified
2026-11-14
Generated
2026-11-14
AI Q&A
2026-11-14
EPSS Evaluated
N/A
NVD
CVE-2026-117487
EUVD
EUVD-2026-125858

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Flatsome From 0 (inc) to 3.20.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Flatsome WordPress theme before version 3.20.13 has a vulnerability where unauthenticated users can access unpublished posts like drafts or pending posts through an AJAX action called flatsome_ajax_apply_shortcode. This happens because the theme does not check user capabilities or verify a valid request nonce, allowing unauthorized disclosure of sensitive content.

Detection Guidance

To detect this vulnerability, check if your Flatsome theme version is below 3.20.13. You can use WordPress admin panel or run the command: wp theme list --name=flatsome --fields=name,version. If the version is older than 3.20.13, the site is vulnerable.

Impact Analysis

This vulnerability can expose sensitive or confidential information stored in unpublished posts, such as draft articles, pending pages, or private content. Attackers could exploit this to steal data before it is officially published, leading to potential privacy breaches or misuse of unpublished material.

Mitigation Strategies

Immediately update the Flatsome theme to version 3.20.13 or later. This can be done via WordPress admin panel under Appearance > Themes or using the command: wp theme update flatsome.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-117487. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...