High severity · published Oct 29, 2026
CVE-2026-118077
WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability
New
7.2
CVSS
–
EPSS
No
On KEV
Description
Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Sastra Essential Addons for Elementor · Fast Themes
through 1.2.3 · source: vendor
Affected product
SE
Sastra Essential Addons for Elementor
Fast Themes
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118077
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118077
vdb-entry
https://patchstack.com/database/wordpress/plugin/sastra-essential-addons-for-elementor/vulnerability/wordpress-sastra-essential-addons-for-elementor-plugin-1-2-3-php-object-injection-vulnerability?_s_id=cve
More from Sastra Essential Addons for Elementor
6.5
CVE-2024-51674
WordPress Sastra Essential Addons for Elementor plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability