{"id":"CVE-2026-118073","kind":"vulnerability","aliases":["CVE-2026-118073"],"related":[],"title":"WordPress News Kit Elementor Addons: PHP object injection by subscribers","description":"Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.","summary":"News Kit Elementor Addons up to version 1.5.0 lets a logged-in subscriber inject serialized PHP objects. An attacker with a basic subscriber account may be able to run code or alter data on the site.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","php","wordpress"],"not_affected_if":["closed-registration","plugin-not-installed"],"how_to_check":"- Check whether the News Kit Elementor Addons plugin is installed and its version (1.5.0 or earlier is affected per the sources)\n- Confirm whether subscriber-level accounts can register on the site","fix":"- Update News Kit Elementor Addons to a version later than `1.5.0`; the exact fixed version is unknown","status":"open","published_at":"2026-10-29T16:18:01+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","triaged_at":"2026-10-29T16:28:08+00:00","updated_at":"2026-10-29T16:28:08+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T16:28:08Z","model":"claude-haiku-5-5","output":{"fix":"- Update News Kit Elementor Addons to a version later than `1.5.0`; the exact fixed version is unknown","reach":"internet","title":"WordPress News Kit Elementor Addons: PHP object injection by subscribers","impact":"high","summary":"News Kit Elementor Addons up to version 1.5.0 lets a logged-in subscriber inject serialized PHP objects. An attacker with a basic subscriber account may be able to run code or alter data on the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elementor","php"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs code on the WordPress server via object injection","analyst_note":"Confirm the fixed plugin version and the exact exploit chain from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-118073) or the plugin's changelog.","how_to_check":"- Check whether the News Kit Elementor Addons plugin is installed and its version (1.5.0 or earlier is affected per the sources)\n- Confirm whether subscriber-level accounts can register on the site","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","closed-registration"],"who_is_affected":"Sites running the News Kit Elementor Addons WordPress plugin at version 1.5.0 or earlier are exposed. The attacker needs a subscriber account, so sites that allow open registration are the most at risk; sites without that plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000696,"input_tokens":4060,"output_tokens":579,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118073':13A,16A '-2026':12A,15A '1.5.0':28B,67C 'abl':48B 'account':45B 'addon':5A,24B,66C 'alter':53B 'attack':40B 'basic':43B 'code':51B 'cve':11A,14A 'data':54B 'elementor':4A,17B,23B,65C 'inject':8A,35B,61C 'kit':3A,22B,64C 'let':29B 'log':32B 'logged-in':31B 'may':46B 'news':2A,21B,63C 'object':7A,38B,60C 'packag':18B 'php':6A,19B,37B,59C 'run':50B 'serial':36B 'site':57B 'subscrib':10A,34B,44B,58C 'version':27B,68C 'wordpress':1A,20B","nicknames":[],"mitigations":[],"who_affected":"Sites running the News Kit Elementor Addons WordPress plugin at version 1.5.0 or earlier are exposed. The attacker needs a subscriber account, so sites that allow open registration are the most at risk; sites without that plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118073","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118073","severity":null,"published_at":"2026-10-29T16:18:01+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","fetched_at":"2026-10-29T16:25:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}