CVE-2026-65549

The CVSS 7.2 rating for this PHP Object Injection in Jeg Kit for Elementor hinges on an 'Author' privilege requirement, but that boundary is far more porous than the score implies. On WordPress deployments running Elementor — a common configuration — Authors frequently have template manipulation, shortcode execution, or CSS-based vectors that already provide functional code execution. This vulnerability doesn't necessarily create new access; it provides a quieter alternative that evades detection rules tuned for template-based attacks. The low EPSS score (0.0037) likely reflects that no universal gadget chain has been publicly documented yet, not that the vulnerability is inherently low-risk. PHP Object Injection severity is dictated by what follows the unserialize() call, and in the WordPress plugin ecosystem, loadable classes accumulate in the global namespace from dozens of co-installed plugins. Gadget chains don't need to 'emerge' — many are already present in deprecated widget classes, abandoned features, or autoloaded registries that persist long after their original context expires. What makes this vulnerability structurally more dangerous than the CVSS suggests is the shared hosting blast radius. WordPress sites on shared infrastructure often execute under the same system user. A PHP Object Injection triggered from one site's Author account doesn't compromise just that site — it can pivot to every site on that server, turning a single vulnerable plugin into a concentration risk. For detection engineering, the key distinction is that this attack leaves different forensic signatures than template manipulation. Shortcode and widget abuse can be fingerprinted and monitored; an atomic unserialize() followed by a custom gadget chain is structurally harder to detect with standard WordPress security rules. Assume gadget chains will surface over the next 6-18 months, as they consistently do for WordPress plugin deserialization bugs. Do not deprioritize patching because 'Authors already have code execution.' That reasoning will extend the exposure window precisely when threat actors are mapping loadable classes in Jeg Kit and its common co-installs. The presence of multiple redundant paths doesn't reduce severity — it multiplies the attack surface an attacker can choose from.

Reviewed through automated stages and approved by a human before publication.