What is the CVSS score of EUVD-2026-51433?

EUVD-2026-51433 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of ElementsKit Elementor Addons are affected by EUVD-2026-51433?

ElementsKit Elementor Addons for WordPress (versions before 3.10.01) contains a remote code execution vulnerability affecting authenticated administrators, with critical risk on WordPress multisite…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-51433?

Yes, a public proof-of-concept exploit is available for EUVD-2026-51433. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-51433?

Within 24 hours: identify all WordPress installations using ElementsKit Elementor Addons and document version numbers; notify all site administrators of the vulnerability and patch availability. Within 7 days: deploy ElementsKit Elementor Addons version 3.10.01 or later to all production WordPress instances, prioritizing multisite network deployments; verify successful updates and test site functionality post-patch. Within 30 days: implement administrative access auditing on all WordPress instances to detect any unauthorized code execution attempts; conduct a post-patch security review of multisite network privilege boundaries and access controls.

ElementsKit Elementor Addons EUVD-2026-51433

| CVE-2026-13392 HIGH

Code Injection (CWE-94)

2026-07-31 WPScan

GHSA-v7rm-2jj2-cc35

PHP WordPress RCE Code Injection Elementskit Elementor Addons Unknown

7.2

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

S:C reflects multisite subsite-admin escaping host authorization boundary; other metrics align with official vector.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 17:23 vuln.today

CVSS changed

Jul 31, 2026 - 17:22 NVD

7.2 (HIGH)

Patch available

Jul 31, 2026 - 07:01 EUVD

CVE Published

Jul 31, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 31, 2026 - 06:00 cve.org

HIGH 7.2

DescriptionCVE.org

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently executes, allowing arbitrary PHP code to run on the server; on a multisite network this lets a non-super subsite Administrator, who is otherwise denied code/file editing, reach host-level code execution beyond the privileges the network grants them.

Articles & Coverage 1

News 17 New WordPress Vulnerabilities - 2 Critical, 13 With POC Aug 01, 2026

AnalysisAI

Remote code execution in the ElementsKit Elementor Addons WordPress plugin before 3.10.01 allows an authenticated administrator to inject arbitrary PHP code into server-side execution by crafting a malicious custom widget definition. The plugin writes this definition verbatim into a generated PHP file and subsequently executes it without sanitization. The critical escalation scenario occurs on WordPress multisite networks, where a subsite Administrator - ordinarily barred from file or code editing - can exploit this flaw to achieve host-level code execution, bypassing the privilege boundaries the network enforces. A publicly available exploit exists; no confirmed active exploitation (CISA KEV) at time of analysis.

Technical ContextAI

ElementsKit Elementor Addons is a WordPress plugin extending the Elementor page builder with custom widget functionality. The vulnerability is rooted in CWE-94 (Improper Control of Generation of Code / Code Injection): when an administrator saves a custom widget definition, the plugin serializes that definition and writes it directly into a PHP file on the server without stripping or escaping executable PHP syntax. On subsequent page loads or plugin operations, WordPress includes and executes that generated file. The affected CPE is cpe:2.3:a:unknown:elementskit_elementor_addons:*:*:*:*:*:*:*:* across all versions prior to 3.10.01. The PHP file-generation sink is the core attack surface; this is a classic server-side template/code injection pattern where untrusted input pollutes a code-generation pipeline.

RemediationAI

Vendor-released patch: version 3.10.01. Administrators should update the ElementsKit Elementor Addons plugin to 3.10.01 or later immediately via the WordPress plugin dashboard or by downloading from the plugin repository. The WPScan advisory at https://wpscan.com/vulnerability/955cbef5-51c3-4d10-86d2-e2882bbb56a4/ provides confirmation of the fix. For operators who cannot patch immediately, the most effective compensating control is to revoke or audit who holds the WordPress Administrator role, particularly on multisite networks where subsite Administrators should not be semi-trusted parties. Disabling the custom widget definition feature within ElementsKit settings, if that option is exposed, would eliminate the vulnerable code path. Network-layer Web Application Firewall rules blocking PHP tag sequences in POST bodies targeting ElementsKit widget endpoints may reduce risk but are bypassable via encoding. Note that any workaround short of patching leaves the underlying file-write sink intact.