CVE-2026-13392: ElementsKit Elementor Addons RCE Vulnerability

CVE-2026-13392 Overview

CVE-2026-13392 is a PHP code injection vulnerability in the ElementsKit Elementor Addons WordPress plugin versions before 3.10.01. The plugin writes custom-widget definitions saved by an administrator directly into a generated PHP file, which the plugin later executes. Attackers with administrative capabilities can inject arbitrary PHP code that runs on the underlying host. On WordPress multisite deployments, a non-super subsite Administrator, otherwise restricted from code or file editing, gains host-level code execution beyond the privileges the network grants them. The flaw is tracked as CWE-94: Improper Control of Generation of Code.

Critical Impact
Subsite administrators on WordPress multisite networks can escalate to host-level PHP code execution, bypassing multisite privilege boundaries and compromising the entire hosting environment.

Affected Products

ElementsKit Elementor Addons WordPress plugin versions prior to 3.10.01
WordPress single-site installations with the plugin activated
WordPress multisite networks with the plugin enabled on subsites

Discovery Timeline

2026-07-31 - CVE-2026-13392 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-13392

Vulnerability Analysis

The ElementsKit Elementor Addons plugin allows administrators to define custom widgets through its interface. When a widget definition is saved, the plugin serializes the supplied content and writes it verbatim into a PHP file on disk. The plugin then includes and executes that generated file as part of its rendering pipeline. Because user-supplied content flows into executable PHP source without sanitization or escaping, any PHP payload embedded in the widget definition executes with the privileges of the web server process. The vulnerability requires high privileges to exploit, but the privilege boundary it crosses matters most on multisite networks where subsite Administrators are explicitly denied file and code editing through the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS constants.

Root Cause

The root cause is improper control of code generation [CWE-94]. The plugin treats administrator-supplied widget input as trusted PHP source and emits it into a .php file that is later included by the runtime. There is no sandboxing, tokenization, or use of a safe templating layer that would separate data from executable code. The multisite privilege model assumes subsite Administrators cannot introduce PHP into the system, and this plugin breaks that assumption.

Attack Vector

An authenticated attacker with WordPress administrator capabilities on any site running the vulnerable plugin creates or edits a custom ElementsKit widget. The attacker embeds PHP code inside the widget definition. When the plugin regenerates its widget PHP file, the payload is written to disk and executed on the next request that triggers widget rendering. On multisite, a subsite Administrator with no file-editing rights can still reach the plugin's widget interface and achieve host-level RCE, effectively bypassing the network's privilege segmentation.

See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-13392

Indicators of Compromise

Unexpected modifications to PHP files inside the wp-content/plugins/elementskit-lite/ or elementskit/ directories, particularly generated widget files.
New or altered custom-widget records in the WordPress wp_options or wp_posts tables containing PHP tags such as <?php or <?=.
Web server processes (php-fpm, apache2, nginx workers) spawning shells, executing curl/wget, or initiating outbound connections shortly after widget save actions.
Files created outside expected plugin paths with recent modification times matching administrator widget-save events.

Detection Strategies

Monitor file integrity on the plugin directory and alert on writes to any file matching the generated widget path pattern.
Correlate WordPress audit-log events for widget creation or edit actions with subsequent PHP file modifications on disk.
Inspect stored widget definitions for PHP opening tags, eval(, system(, exec(, base64_decode(, or assert( substrings.
Alert on child processes of the PHP handler that are not part of the normal WordPress workload.

Monitoring Recommendations

Enable verbose logging of administrative actions in WordPress and forward admin_action and save_post events to a centralized log platform.
Track privileged user activity on multisite subsites, focusing on Administrator accounts that suddenly interact with ElementsKit widgets.
Baseline outbound network traffic from web nodes and alert on new destinations initiated from PHP worker processes.
Review scheduled tasks (wp-cron, system cron) for entries added after suspicious widget activity.

How to Mitigate CVE-2026-13392

Immediate Actions Required

Upgrade the ElementsKit Elementor Addons plugin to version 3.10.01 or later on every site and multisite subsite.
Audit the list of users holding administrator and edit_pages/edit_posts capabilities and remove any that are not required.
Review all existing custom ElementsKit widget definitions for embedded PHP and delete any that contain executable code.
Rotate WordPress administrator credentials and API keys if unexplained widget modifications are found.

Patch Information

Update to ElementsKit Elementor Addons 3.10.01 or later, which prevents administrator-supplied widget content from being written verbatim into executable PHP. Refer to the WPScan Vulnerability Report for the fixed version reference.

Workarounds

Deactivate the ElementsKit Elementor Addons plugin until the update to 3.10.01 can be applied.
Set define('DISALLOW_FILE_MODS', true); in wp-config.php on multisite networks to block plugin activation and updates by subsite Administrators, reducing exposure of vulnerable installs.
Restrict write permissions on the plugin directory at the filesystem layer where operationally feasible.
Deploy a web application firewall rule that blocks POST requests containing <?php or <?= in ElementsKit widget-save endpoints.

bash

# Configuration example: harden multisite against plugin-driven code writes
# Add to wp-config.php
define('DISALLOW_FILE_EDIT', true);
define('DISALLOW_FILE_MODS', true);

# Verify installed ElementsKit version via WP-CLI
wp plugin get elementskit-lite --field=version
wp plugin update elementskit-lite --version=3.10.01