ElementsKit Elementor Addons CVE-2026-13392

Exploitation requires an authenticated WordPress Administrator account (PR:H per CVSS vector). On a standard single-site WordPress installation this limits exposure to administrators who already have significant system access, reducing the marginal risk. The critical escalation condition is a WordPress multisite network deployment: a subsite Administrator role - which is explicitly denied file editing and code execution capabilities by the multisite privilege model - can trigger this vulnerability because the plugin does not enforce super-administrator checks before allowing custom widget definitions to be written to PHP files. The custom widget definition feature of the ElementsKit Elementor Addons plugin must be accessible to the attacker's role. No special network positioning is required beyond authenticated web access (AV:N). No user interaction is required beyond the attacker's own actions (UI:N).

The official CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects that exploitation requires high privileges (site Administrator), which typically limits the real-world attack surface significantly. However, the S:U (Unchanged Scope) metric understates the multisite escalation scenario: a non-super subsite Administrator escaping their authorization boundary to reach host-level execution is precisely the definition of a scope change (S:C), suggesting the NVD-assigned score may be conservative. Against that backdrop, the independently assessed vector with S:C yields a materially higher base score. EPSS sits at 0.19% (9th percentile), indicating low probability of widespread opportunistic exploitation in the near term, consistent with the high-privilege prerequisite. However, a publicly available exploit (sourced via WPScan) lowers the barrier for targeted abuse against misconfigured multisite deployments where subsite admins are considered semi-trusted. The vulnerability is not listed in CISA KEV, meaning no confirmed active exploitation. Priority should be elevated for WordPress multisite operators who grant subsite Administrator roles to partially-trusted parties.

An attacker holding a WordPress Administrator account (or a subsite Administrator account on a multisite network) navigates to the ElementsKit custom widget editor and saves a widget definition containing embedded PHP code such as a web shell or reverse shell payload. The plugin writes this input verbatim into a server-side PHP file; when that file is subsequently included by the plugin, the injected PHP executes in the web server process context. A publicly available exploit from WPScan demonstrates this technique, lowering the skill bar for exploitation.