Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Flatsome theme lets attackers change site without permission

CVE-2026-57729 · published 3 months ago
Summary

The Flatsome website theme, up to version 3.20.5, does not correctly verify who is allowed to make changes. Because of this, a person who should not have access could alter the site’s appearance or content. Update the theme to the newest release and make sure only trusted users have admin rights.

Original advisory text
Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flatsome: from n/a through <= 3.20.5.
Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flatsome: from n/a through <= 3.20.5.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published13 Jul 2026
Updated4 Nov 2026
First seen13 Jul 2026
Sources
CVE-2026-57729 · NVD
Track software like this
Free during beta