---
id: "CVE-2026-118077"
kind: "vulnerability"
aliases: ["CVE-2026-118077"]
title: "Sastra Essential Addons for Elementor: PHP object injection via author field"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["authenticated", "elementor", "package", "php", "wordpress", "wordpress-plugin"]
not_affected_if: ["no-admin-users", "plugin-not-installed"]
published_at: "2026-10-29T16:18:02+00:00"
first_seen_at: "2026-10-29T16:25:57+00:00"
updated_at: "2026-10-29T16:38:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118077", "first_seen_at": "2026-10-29T16:25:57+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T16:38:08+00:00"}]
---

# Sastra Essential Addons for Elementor: PHP object injection via author field

Sastra Essential Addons for Elementor, a WordPress plugin, versions up to and including 1.2.3 contain a PHP Object Injection flaw in author handling. A successful attack can lead to arbitrary PHP object deserialization, which may allow code execution or data access depending on available gadget chains.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the WordPress plugin `Essential Addons for Elementor` by Sastra is installed and its version in the plugins list or `wp plugin list`
- Confirm the installed version is above `1.2.3`

## Timeline

- 2026-10-29T16:25:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118077
- 2026-10-29T16:38:08+00:00 analyst — No vendor/maintainer advisory found; NVD page empty via web-cli. Only CNA data (Patchstack, CVSS 7.2, vector PR:H = needs high-privilege/admin account; network, no UI) from the signal. Fix version unknown; settle by Patchstack DB entry or plugin changelog on wordpress.org. Odd: Patchstack lists latest plugin version as 1.0.38 while CVE says <=1.2.3, so the version scheme or plugin slug may differ; verify installed slug. No exploitation or PoC found. Nothing marked verified.

## From the sources

Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_