A PHP Object Injection flaw exists in the Sastra Essential Addons for Elementor plugin up to version 1.2.3. The vulnerability allows an attacker to inject crafted serialized PHP objects, which can be deserialized by the application and used to execute arbitrary code. This weakness is classified under CWE-502 and can compromise the confidentiality, integrity, and availability of the affected WordPress site.

WordPress sites utilizing the Fast Themes Sastra Essential Addons for Elementor plugin at or below version 1.2.3 are impacted. The issue is confined to this plugin and does not affect other WordPress components unless they are vulnerable to a similar injection vector.

The CVSS score of 7.2 denotes a high severity level, indicating significant impact if exploited. The EPSS score is not available, so the exact likelihood of exploitation cannot be determined, but the potential for remote code execution remains high. The vulnerability is not listed in the CISA KEV catalog, yet it can be privately exploited through crafted HTTP requests targeting the vulnerable plugin’s attacker‑controlled input.