This vulnerability (CWE-77) in StylemixThemes Consulting Elementor Widgets and Masterstudy Elementor Widgets allows OS Command Injection due to improper neutralization of special elements in command execution. It affects Consulting Elementor Widgets versions through 1.3.0 and Masterstudy Elementor Widgets through 1.2.2. The CVSS 3.1 score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The vendor has not provided a patch or official remediation at this time, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.

Successful exploitation allows an attacker with low privileges to execute arbitrary operating system commands remotely without user interaction. This can lead to full system compromise, including complete loss of confidentiality, integrity, and availability of the affected system. The vulnerability affects widely used Elementor Widgets by StylemixThemes, potentially impacting websites using these plugins.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently available, users should monitor for vendor updates and consider disabling or removing the affected plugins until a patch is released. Restricting privileges of users who can interact with these widgets may reduce risk but does not eliminate it due to the low privilege requirement.