CVE-2026-13392

A vulnerability exists in ElementsKit Elementor Addons WordPress plugin versions prior to 3.10.01, where user-generated custom widget definitions can be directly inserted into executable PHP files by the plugin, enabling malicious PHP code execution on the server. This flaw has significant implications for multisite networks, allowing non-super Administrator subsite users with limited privileges to bypass network restrictions and execute host-level code.

Based on public CVE data (MITRE/NVD).