---
cve: "CVE-2026-97353"
severity: "MEDIUM"
cvss: 5.4
epss: "0.2%"
vendor: "Unknown"
kev: false
exploited: false
published: "2026-10-24 06:00:18"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-10-28T21:04:55+01:00"
---

# CVE-2026-97353

> 5.4 MEDIUM

## Beschreibung

The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users. This can be used to overwrite protected core metadata and tamper with content created by higher-privileged users.

## CNA-Record (Kanon, cvelistV5)

- CNA: **WPScan**
- State: PUBLISHED
- Stand: 2026-10-24 14:36:54

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Keine | good |
| I Integrität | Gering | warn |
| A Verfügbarkeit | Gering | warn |

## Schwachstellen-Klasse

- **CWE-862** — Missing Authorization
  The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

## Angriffsmuster (CAPEC)

- [CAPEC-665 — Exploitation of Thunderbolt Protection Flaws](https://capec.mitre.org/data/definitions/665.html) _(Severity: Very High)_

## ATT&CK-Techniken

- [T1211 — Exploitation for Defensive Evasion](https://attack.mitre.org/techniques/T1211/)
- [T1542.002 — Pre-OS Boot: Component Firmware](https://attack.mitre.org/techniques/T1542/002/)
- [T1556 — Modify Authentication Process](https://attack.mitre.org/techniques/T1556/)

## Referenzen

- <https://wpscan.com/vulnerability/4114e6a4-d8ed-4456-a15f-4d47034ae75f/>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-97353/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_