CVE-2026-57731
MediumCVSS 6.5Summary
The Flatsome plugin version 3.20.5 and earlier contains a broken access control vulnerability for contributors. A user with the contributor role can gain unauthorized access to functions or data that should be restricted.
Risk Assessment
The risk involves privilege escalation by contributors, potentially leading to unauthorized content modifications, data theft, or site takeover.
Recommendation
Immediately update the Flatsome plugin to a version later than 3.20.5, which includes a fix for this vulnerability.
Other vulnerabilities in Flatsome
See all- CVE-2026-57730Medium
The Flatsome plugin version 3.20.5 and earlier contains a broken access control vulnerability for subscribers. This allows unauthorized users with the subscriber role to access functions or data they should not have permissions for.
- CVE-2026-57729High
The Flatsome plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 3.20.5.
- CVE-2026-57728High
The Flatsome plugin for WordPress contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. The issue affects versions up to and including 3.20.5.
Original NVD description (English source)
Contributor Broken Access Control in Flatsome <= 3.20.5 versions.