Technical impact
The News Kit Addons For Elementor plugin, up to version 1.4.7, fails to verify user privileges before performing an authenticated AJAX action named nekit_update_mega_menu_form. This oversight allows any user with subscriber privileges or higher to write arbitrary post‑metadata entries under attacker‑chosen keys to any post, including those owned by other users. The consequence is a breach of content integrity: an attacker can overwrite protected core metadata, inject malicious information, or alter content created by higher‑privileged users. The weakness corresponds to missing authorization (CWE-862).
Affected Systems
WordPress sites that have installed News Kit Addons For Elementor with a version not newer than 1.4.7. The vulnerability applies to all posts hosted by those sites, regardless of author, provided the site user has a subscriber role or higher.
Risk and Exploitability
EPSS is <1% and the plugin is not listed in CISA KEV. The CVSS score is 5.4, indicating moderate severity. However, because the flaw is exploitable by any logged‑in subscriber, the risk to integrity is high, while the attack requires only authenticated access but no additional privileges. The lack of a publicly available patch means that sites running the affected plugin remain at risk until an update or workaround is applied. Based on the description, the likely attack vector is through an authenticated AJAX request from a logged‑in user with subscriber or higher role.
