Description

Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-06T15:17:16.877Z",
  "pubdate": "2026-08-06T15:17:16.877Z",
  "executiveSummary": "An Object Injection vulnerability has been identified in the Jeg Kit for Elementor plugin affecting versions up to and including 3.2.10. This security flaw stems from insecure handling of serialized data or user-supplied input passed into PHP native deserialization functions within the vulnerable component.\nThe primary impact of this vulnerability is the potential execution of arbitrary code, unauthorized access to sensitive application data, or triggering application-level denial of service conditions, depending on the availability of compatible gadget chains within the application context.\nThe affected product is Jeg Kit for Elementor across versions <= 3.2.10. The risk implications are critical, as successful exploitation could lead to full compromise of the underlying WordPress installation. The capability required by an attacker involves author-level privileges or higher within the target WordPress site to interact with the vulnerable functionality.\nExploitation requirements include authenticated access to the WordPress dashboard with sufficient privileges to invoke the vulnerable endpoints or supply maliciously crafted input parameters containing serialized payloads. Mitigating this vulnerability requires immediate updates to patched versions of the plugin once available, or applying strict input validation and sanitization measures to restrict the processing of untrusted serialized data.",
  "technicalDetails": "The vulnerability resides in the Jeg Kit for Elementor plugin (versions <= 3.2.10) within specific code segments that process user input without adequate validation before passing it to deserialization routines such as unserialize().\nThe root cause of the vulnerability is the unsafe deserialization of untrusted data supplied by authenticated users holding author privileges. When the application reconstructs PHP objects from serialized strings provided via request parameters, it fails to restrict the classes that can be instantiated, allowing attackers to leverage pre-existing classes defined in WordPress core, themes, or active plugins.\nThe attack flow proceeds as follows: An authenticated attacker with author-level privileges crafts a malicious serialized payload containing a specific gadget chain designed to achieve a desired secondary effect, such as arbitrary file manipulation, database interaction, or remote code execution. The attacker submits this payload via an HTTP request targeting the vulnerable component within Jeg Kit for Elementor. Upon receipt, the application insecurely processes the input using a vulnerable function, instantiating the objects specified in the payload. The destruction or invocation of magic methods (such as __wakeup() or __destruct()) within the gadget chain triggers the secondary vulnerability, leading to exploitation.\nThe vulnerable component involves specific backend processing scripts or classes within the plugin that accept and deserialize input parameters. The affected versions strictly encompass Jeg Kit for Elementor <= 3.2.10. Authentication requirements necessitate at least author-level privileges on the target WordPress installation, and network exposure is constrained to the web interface accessible to authenticated users.\nPost-exploitation impact depends heavily on the presence of suitable gadget chains within the PHP application environment. If robust gadget chains are accessible, the attacker can achieve remote code execution, compromise system integrity, escalate privileges further, or pivot to internal network resources accessible from the compromised server."
}