CVE-2026-118077: WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability

Q: Who can exploit this issue?

Exploitation requires author-level privileges. An unauthenticated attacker is not indicated by the available data.

Q: What access does an attacker need?

The CVSS vector lists PR:H, meaning the attacker must already hold high privileges, consistent with the reported author-level requirement. No user interaction is required.

Q: Which plugin versions are affected?

The vulnerability is reported in Sastra Essential Addons for Elementor versions 1.2.3 and earlier.

Q: What is the potential impact if exploited?

The reported CVSS vector indicates high impact to confidentiality, integrity, and availability. The issue is rated high severity with a CVSS score of 7.2.

Published Oct 29, 2026

Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.

Event History

Oct 29, 2026

CVE Published

via MITRE·03:24 PM

Data Sourced

via MITRE·03:24 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Exploitation requires author-level privileges. An unauthenticated attacker is not indicated by the available data.

What access does an attacker need?

The CVSS vector lists PR:H, meaning the attacker must already hold high privileges, consistent with the reported author-level requirement. No user interaction is required.

Which plugin versions are affected?

The vulnerability is reported in Sastra Essential Addons for Elementor versions 1.2.3 and earlier.

What is the potential impact if exploited?

The reported CVSS vector indicates high impact to confidentiality, integrity, and availability. The issue is rated high severity with a CVSS score of 7.2.

CVE-2026-118077: WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need?

Which plugin versions are affected?

What is the potential impact if exploited?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need?

Which plugin versions are affected?

What is the potential impact if exploited?