CVE-2026-13392

If you're running ElementsKit on WordPress Multisite, treat this as a network-level incident regardless of where it manifests. CVE-2026-13392 is a deliberate architectural bypass: the plugin's custom widget feature accepts arbitrary PHP from administrators, persists it as executable files, and includes them on page load. This isn't a traditional injection flaw—an administrator submitting PHP through this feature is exactly what the feature was designed to do. The plugin functions as a personal PHP hosting service for whoever has admin access on any subsite. The Multisite-specific risk is critical. WordPress Multisite isolates subsite administrators from server-level access precisely because plugin installation and file editing enable PHP execution. This CVE lets a subsite admin sidestep that boundary entirely—they don't need network admin credentials because ElementsKit is already executing PHP on their behalf. A single compromised admin account on any subsite becomes a full host compromise. Version 3.10.01 reportedly addresses this, but the fix architecture matters enormously. If it sanitizes input only, expect follow-on CVEs—PHP input sanitization is a known losing battle. If it sandboxes or eliminates the PHP execution pathway entirely, that's a durable fix. You need to verify which approach was taken. For incident response: treat any compromised subsite admin account as equivalent to network admin access. For detection: audit your network for any custom widget definitions containing PHP—these are persisted files that execute on every page load, creating persistent backdoors from what appears to be legitimate functionality. Network administrators should verify whether ElementsKit is network-activated; if it is, every subsite admin has this capability whether they know it or not. On single-site WordPress, this is less severe—a site admin can already install plugins, so this primarily creates a persistence mechanism that survives session boundaries. But the temporal dimension matters: a compromised admin session is temporary, while code persisted through custom widgets survives until被发现 and removed.

Reviewed through automated stages and approved by a human before publication.