Arbitrary PHP Code Execution via Unsafe Widget Definition Storage

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently executes, allowing arbitrary PHP code to run on the server; on a multisite network this lets a non-super subsite Administrator, who is otherwise denied code/file editing, reach host-level code execution beyond the privileges the network grants them.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

ElementsKit Elementor Addons before version 3.10.01 contains a critical code injection vulnerability stemming from unsafe handling of custom widget definitions. Administrators can craft malicious PHP code within widget configurations that the plugin writes directly into executable PHP files without sanitization or validation. This vulnerability is particularly severe in WordPress multisite environments where it allows non-super administrators on subsites—users typically restricted from file and code editing—to achieve remote code execution at the host level. Any organization using ElementsKit for site customization faces potential compromise of their entire WordPress installation and underlying server.

Casky's 322 mapped security skills detect this attack pattern by analyzing behaviors associated with MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Resource Development), combined with the underlying code injection mechanics (CWE-94). Practitioners using Casky would identify suspicious activity patterns including: unauthorized PHP file generation and modification in wp-content directories, unexpected code execution originating from widget configuration processes, privilege escalation attempts from subsite administrators, and file write operations correlating with ElementsKit plugin activity. Claude's extended reasoning capabilities correlate these indicators across multiple detection points, distinguishing legitimate widget customization from exploit attempts that embed executable code. Security teams receive actionable findings highlighting the specific ElementsKit version vulnerability, affected user roles, and the execution chain from widget definition storage through PHP file generation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-13392.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-13392

Casky has 322 skills that investigate the attack patterns behind CVE-2026-13392. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn