CVE-2026-57729
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
The Flatsome plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 3.20.5.
Risk Assessment
An attacker can gain unauthorized access to administrative functions or sensitive data, potentially leading to full compromise of the WordPress site.
Recommendation
Immediately update the Flatsome plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in Flatsome
See all- CVE-2026-57731Medium
The Flatsome plugin version 3.20.5 and earlier contains a broken access control vulnerability for contributors. A user with the contributor role can gain unauthorized access to functions or data that should be restricted.
- CVE-2026-57730Medium
The Flatsome plugin version 3.20.5 and earlier contains a broken access control vulnerability for subscribers. This allows unauthorized users with the subscriber role to access functions or data they should not have permissions for.
- CVE-2026-57728High
The Flatsome plugin for WordPress contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. The issue affects versions up to and including 3.20.5.
Original NVD description (English source)
Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flatsome: from n/a through <= 3.20.5.