Arbitrary Code Execution in ElementsKit Elementor Addons Plugin for WordPress
CVE-2026-13392
Currently unrated
What is CVE-2026-13392?
The ElementsKit Elementor Addons for WordPress prior to version 3.10.01 allows users with administrative privileges to define custom widgets that are saved directly into a generated PHP file. This flaw leads to the execution of arbitrary PHP code on the server. In a multisite environment, a subsite administrator can exploit this vulnerability to gain host-level code execution, bypassing the restrictions typically imposed on code and file editing by the network's configuration.
Affected Version(s)
ElementsKit Elementor Addons 0 < 3.10.01
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.