CVE-2020-26596

Elementor Pro versions before 3.0.6 contain a code execution vulnerability in the Dynamic OOO widget that permits authenticated users with Editor role permissions to upload and execute arbitrary PHP code through the PHP Raw snippet feature. An attacker with Editor-level access could leverage this flaw to achieve remote code execution on the affected WordPress installation. The vulnerability was resolved in version 3.0.6, though administrators can mitigate the risk by disabling the Dynamic OOO widget or limiting Editor role assignments.

Based on public CVE data (MITRE/NVD).