Executive brief
ElementsKit, a popular extension for the Elementor website builder on WordPress, contains a security flaw in its custom widget builder. This vulnerability allows a site administrator to inject and execute malicious code on the underlying web server. While administrators typically have high privileges, this is particularly dangerous in 'Multisite' environments where a sub-site owner could use this flaw to take control of the entire network and access data from other sites they do not own.
Technical details
A PHP code injection vulnerability exists in the ElementsKit Elementor Addons plugin (Lite version) prior to 3.10.01. The issue resides in the custom widget builder component, which fails to sanitize or validate widget definitions before writing them directly into a generated PHP file. This file is subsequently executed by the plugin. An attacker with administrative privileges can inject arbitrary PHP code into these definitions to achieve Remote Code Execution (RCE). In a WordPress Multisite configuration, this allows a subsite Administrator—who is normally restricted from editing code or files—to bypass these security boundaries and execute code at the host level. The vulnerability is addressed in version 3.10.01.
Affected products
- WPMet ElementsKit Elementor Addons (Lite) < 3.10.01
Timeline
- 2026-07-14: disclosed: Initial public disclosure by WPScan
- 2026-07-14: patched: Fixed in version 3.10.01
- 2026-07-31: advisory: NVD publication date