CVE-2026-65549 HIGH

CVE-2026-65549: WordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerability

Vendor Jegtheme

Product Jeg Kit for Elementor

Weakness CWE-502 · Unsafe deserialization

Published August 6, 2026

Last update August 6, 2026

View on NVD All CVEs

CVSS base score

7.2/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Jeg Kit for Elementor versions up to 3.2.10 contain a deserialization vulnerability in how the plugin processes untrusted data. An authenticated administrator can craft malicious serialized input to execute arbitrary PHP code on the site. This requires high-level admin access and affects confidentiality, integrity, and availability of the WordPress installation.

What an attacker can do

03Attacker Capabilities

Run arbitrary PHP code on the site with full site privileges.

Potential impact on your site

04Site Impact

A compromised admin account can fully compromise your site, steal data, modify content, or install backdoors.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access to the WordPress site.

Key dates

06Disclosure timeline

August 6, 2026 CVE published

August 6, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-65549 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/502.html AskarLabs — CWE-502 write-up Deserialization of Untrusted Data

Related vulnerabilities