The Essential Addons for Elementor plugin up to version 5.9.13 is vulnerable to PHP Object Injection due to unsafe deserialization of untrusted data from the 'error_resetpassword' attribute in the Login | Register Form widget. This vulnerability requires authenticated access at author level or above. Exploitation depends on the presence of a gadget chain (POP chain) in the environment, which could lead to arbitrary file deletion, sensitive data disclosure, or remote code execution. The vulnerability is tracked as CWE-502 and has a CVSS 3.1 score of 8.8, indicating high severity.

Successful exploitation can lead to high-impact consequences including arbitrary code execution, deletion of files, and disclosure of sensitive information. The attack requires authenticated access with author-level privileges or higher. The vulnerable widget is disabled by default, which may reduce exposure but does not eliminate risk if enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict author-level access to trusted users only and consider disabling the vulnerable Login | Register Form widget if it is enabled. Monitor vendor channels for updates and apply patches promptly once available.