News Kit Elementor Addons EUVD-2026-112990

Requires an authenticated WordPress account at subscriber level (the lowest-privilege role), matching PR:L, so exploitation is gated by either open user registration or an attacker already holding a low-tier account; no user interaction or elevated privileges are needed. The flaw is unsafe deserialization (CWE-502) of attacker-supplied data in News Kit Elementor Addons versions 1.5.0 and earlier; the specific endpoint, parameter and deserialization sink are not described in the available sources. The real-world impact of the object injection further depends on a usable POP gadget chain being present in the plugin or co-installed code, which the sources do not confirm.

This is a genuine high-severity issue but not an emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with full confidentiality, integrity and availability impact - consistent with PHP Object Injection (CWE-502) that can escalate to code execution or full site compromise when a usable POP gadget chain is present. The 'Subscriber' qualifier and PR:L together mean an authenticated, lowest-tier WordPress account is required, which meaningfully limits mass exploitation compared with a fully unauthenticated flaw - though sites that permit open user registration effectively lower that barrier. No EPSS score, no CISA KEV listing, and no confirmed exploit code are present in the input, so there is no signal of active or widespread exploitation; the only external signal is the vuln.today priority of 'this_week' and the Patchstack advisory. The signals are therefore consistent rather than conflicting: high potential impact, authenticated precondition, and no evidence of in-the-wild use - a prioritize-and-patch item rather than a drop-everything incident. Note the realized impact of object injection depends on an available gadget chain, which the available sources do not confirm.

An attacker obtains or registers a subscriber-level WordPress account on a site running News Kit Elementor Addons 1.5.0 or earlier, then submits a crafted serialized PHP payload to the vulnerable code path. If a suitable POP gadget chain exists in the plugin or other installed code, the resulting object injection can be leveraged toward actions such as file operations, data disclosure, or code execution. No public exploit code is identified in the provided data, and the exact trigger is not described in the available sources.