News Kit Elementor Addons: PHP Object Injection by Subscriber users
The WordPress plugin News Kit Elementor Addons up to and including version 1.5.0 contains a PHP Object Injection flaw (CWE-502). An attacker with a Subscriber account can submit crafted serialized data that the plugin processes unsafely, which can lead to code execution, data access or manipulation on the server, depending on other installed components. No official patch was available at the time of research, and the fixed version is unknown.
BlazeThemes · News Kit Elementor Addons
