CVE-2026-117487

{
  "etk_id": "ETK-2026-4445",
  "cve_id": "CVE-2026-117487",
  "display_id": "CVE-2026-117487",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-125858",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated unpublished-post disclosure in Flatsome",
  "summary": "Flatsome versions earlier than 3.20.13 can expose unpublished WordPress post content through an AJAX action. An unauthenticated remote party may read draft or pending posts if they can reference the relevant post by ID.",
  "mitigation": "Update the Flatsome theme to version 3.20.13 or later. Restrict public access to the affected site until the update is applied.",
  "vendor": null,
  "product": "Flatsome",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 3.20.13"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "3.20.13"
      ],
      "package_name": "Flatsome",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 30.110999133333333,
  "t0_at": "2026-11-14T06:00:06.518000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-14T07:12:19.590044+00:00",
      "days": 0.05015129680555556,
      "is_lower_bound": false,
      "measured_at": "2026-11-14T06:00:06.518000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-14T06:00:06.518000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-14T06:00:06.518000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-117487"
    }
  }
}