Skip to content
Fencer Intel
no cvss —

CVE-2026-117490 json

Flatsome < 3.20.13 - Contributor+ Post Type and Status Overwrite via ux_builder_save

published 1h ago modified 1h ago also EUVD-2026-125859

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no EPSS score yet
public exploits
0
none known

Summary

The Flatsome WordPress theme before 3.20.13 does not enforce the acting user's publish and post-type restrictions on an AJAX save action, allowing users with a role as low as Contributor to publish their own content and change its post type (for example to a product) without holding the required capabilities.

Patch / fix

  • Unknown Flatsome 3.20.13

Is CVE-2026-117490 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploits and checks

  • wpscan.com https://wpscan.com/vulnerability/152c9cda-ec73-42e3-b7a3-3a133338db8b/ referenced PoC, tagged "exploit" by a source, unverified

Affected products

  • Unknown Flatsome

Classification

Weakness
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.