What is the CVSS score of CVE-2026-65549?

CVE-2026-65549 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Jeg Kit for Elementor are affected by CVE-2026-65549?

Jeg Kit for Elementor WordPress plugin (versions ≤3.2.10) contains a PHP Object Injection vulnerability that could allow authenticated users with Author-level privileges to execute arbitrary code and…

How to fix or mitigate CVE-2026-65549?

Within 24 hours, audit all WordPress Author-level user accounts to identify which are active and necessary. Within 7 days, check the plugin vendor's security advisory channel and Patchstack for patch availability; apply any released patch immediately, or if unavailable, implement compensating controls such as restricting Author role assignments and monitoring user activity. Within 30 days, once a vendor patch is released and validated in staging, deploy it across all production WordPress instances running Jeg Kit for Elementor ≤3.2.10.

Jeg Kit for Elementor CVE-2026-65549

EUVD-2026-53979 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-08-06 Patchstack

GHSA-fqjr-2fvx-4r2w

PHP WordPress Deserialization Wordpress Plugin Jeg Kit For Elementor Jegtheme

7.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Author role is a low-trust authenticated tier (PR:L), not administrative; AC:L because exploitation requires only a crafted serialized payload once authenticated.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:34 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.2

DescriptionCVE.org

Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.

AnalysisAI

PHP Object Injection in Jeg Kit for Elementor (WordPress plugin, versions <= 3.2.10) allows authenticated attackers holding Author-level WordPress privileges to pass unsanitized input through PHP's deserialization mechanism, potentially triggering a Property-Oriented Programming (POP) chain present in the environment. If a suitable POP chain exists - contributed by the plugin itself, Elementor, or any co-installed dependency - the attacker can achieve remote code execution, arbitrary file manipulation, or full data disclosure on the WordPress host. No public exploit or CISA KEV listing has been identified at time of analysis, though Patchstack has formally catalogued the issue.

Technical ContextAI

CWE-502 (Deserialization of Untrusted Data) describes vulnerabilities where attacker-controlled data is passed to a language-native deserialization function - in this case PHP's unserialize(). When PHP deserializes an object, it automatically invokes magic methods (__wakeup, __destruct, __toString) on the reconstituted class. If any class loaded in the PHP process at runtime exposes a usable magic-method chain (a POP chain), an attacker can craft a malicious serialized payload that redirects execution. The affected product, Jeg Kit for Elementor by JegTheme (CPE: cpe:2.3:a:jegtheme:jeg_kit_for_elementor:*:*:*:*:*:*:*:*), is an Elementor page-builder add-on for WordPress. The 'Author' qualifier in the vulnerability title indicates the injectable input surface is accessible to WordPress users holding at minimum the Author role, meaning the vulnerable unserialize() call handles data controlled by that privilege tier.

RemediationAI

Update Jeg Kit for Elementor to a version above 3.2.10 as soon as it becomes available; patch availability is confirmed per the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/jeg-elementor-kit/vulnerability/wordpress-jeg-elementor-kit-plugin-3-2-10-php-object-injection-vulnerability), though an exact patched release version was not independently confirmed in the provided intelligence data - verify the current release version in the WordPress plugin repository before updating. If an immediate update is not possible, restrict Author-level account creation and audit existing Author accounts for untrusted users, since reducing the pool of users who can reach the vulnerable input surface is the most targeted compensating control. Additionally, a Web Application Firewall rule blocking serialized PHP payloads (patterns matching O:, a:, s: with numeric prefixes in POST bodies) can provide shallow detection, though it may generate false positives on legitimate serialized content. Disabling the specific Jeg Kit widget or feature that handles the injectable input - if identifiable from the Patchstack disclosure - is a surgical workaround that avoids disrupting the rest of the plugin.