Live › vulnerability › CVE-2026-118077
Sastra Essential Addons for Elementor, a WordPress plugin, versions up to and including 1.2.3 contain a PHP Object Injection flaw in author handling. A successful attack can lead to arbitrary PHP object deserialization, which may allow code execution or data access depending on available gadget chains.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Sites running the Sastra Essential Addons for Elementor WordPress plugin at version 1.2.3 or earlier are exposed. Sites without this plugin, or running a newer version, are not affected by this entry. The sources do not describe the exact trigger conditions.
No product ranges from the sources yet.
Essential Addons for Elementor by Sastra is installed and its version in the plugins list or wp plugin list1.2.3Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-118077")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.