CVE-2026-118077

Name of the Vulnerable Software and Affected Versions Sastra Essential Addons for Elementor versions prior to 1.2.4

Description The software is susceptible to PHP Object Injection, a condition where untrusted input is deserialized, allowing authenticated users with author-level access or higher to inject a PHP Object. While no internal POP chain (a sequence of gadgets used to execute malicious code during deserialization) is present in the software itself, the presence of a POP chain in other installed plugins or themes could enable an attacker to execute code, retrieve sensitive data, or delete arbitrary files.

Recommendations Update Sastra Essential Addons for Elementor to version 1.2.4 or later.