The ElementsKit Elementor Addons WordPress plugin allows a user with administrative access to define a custom widget that is written verbatim into a PHP file on the server. This file is subsequently executed by the plugin, allowing the attacker to run arbitrary PHP code. The result is a full compromise of the web server, providing an attacker with host‑level code execution beyond the privileges normally granted to a subsite administrator on a multisite network.

The vulnerability is present in all versions of ElementsKit Elementor Addons prior to 3.10.01, especially on multisite WordPress installations. Users who own a subsite with administrative rights can exploit the flaw, while super‑administrators are not affected by the attack vector described.

With an EPSS score of 0.0037, the exploit probability is very low but non‑zero. The flaw delivers remote code execution, which is the highest impact level. The absence of a KEV listing does not diminish the critical nature of the vulnerability. The attack requires the ability to create or edit a custom widget within the plugin, a task typically limited to site administrators. Once achieved, the attacker can run arbitrary PHP, potentially exfiltrating data, installing backdoors, or elevating privileges on the host.