EUVD-2026-53979
GHSA-fqjr-2fvx-4r2w
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Author role is a low-trust authenticated tier (PR:L), not administrative; AC:L because exploitation requires only a crafted serialized payload once authenticated.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.
AnalysisAI
PHP Object Injection in Jeg Kit for Elementor (WordPress plugin, versions <= 3.2.10) allows authenticated attackers holding Author-level WordPress privileges to pass unsanitized input through PHP's deserialization mechanism, potentially triggering a Property-Oriented Programming (POP) chain present in the environment. If a suitable POP chain exists - contributed by the plugin itself, Elementor, or any co-installed dependency - the attacker can achieve remote code execution, arbitrary file manipulation, or full data disclosure on the WordPress host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress account with Author-level privileges or higher on the target site - PR:H per the assigned CVSS vector, though Author role is arguably low-privilege in WordPress terms. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The assigned CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2) reflects full confidentiality, integrity, and availability impact but gates exploitation behind PR:H (high privileges). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or compromises a WordPress account with Author-level privileges on a target site running Jeg Kit for Elementor <= 3.2.10. The attacker crafts a serialized PHP object exploiting a POP chain drawn from classes available in the WordPress runtime - for example, a file-deletion or code-execution gadget from Elementor core or a co-installed plugin - and submits it through the vulnerable input field exposed by the plugin. … |
| Remediation | Update Jeg Kit for Elementor to a version above 3.2.10 as soon as it becomes available; patch availability is confirmed per the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/jeg-elementor-kit/vulnerability/wordpress-jeg-elementor-kit-plugin-3-2-10-php-object-injection-vulnerability), though an exact patched release version was not independently confirmed in the provided intelligence data - verify the current release version in the WordPress plugin repository before updating. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress Author-level user accounts to identify which are active and necessary. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today