The ElementsKit Elementor Addons WordPress plugin prior to version 3.10.01 does not properly control the generation of PHP code from user-supplied custom-widget definitions. An administrator can save a widget definition that is directly written into a PHP file and executed by the plugin, resulting in arbitrary PHP code execution on the server. This vulnerability is classified as CWE-94 (Improper Control of Generation of Code). On multisite WordPress installations, this vulnerability enables a non-super subsite Administrator to bypass restrictions and achieve host-level code execution.

Successful exploitation allows an attacker with administrative privileges to execute arbitrary PHP code on the server hosting the WordPress site. This can lead to full compromise of the server, including data theft, service disruption, or further lateral movement. On multisite networks, the impact is elevated as subsite Administrators can escalate their privileges beyond intended limits, potentially compromising the entire host.

No official patch or remediation has been confirmed yet. Users should upgrade to version 3.10.01 or later once available, as the vulnerability affects versions before 3.10.01. Until a fix is released, restrict administrative access to trusted users only and consider disabling the plugin if possible. Monitor the vendor advisory for updates on patch availability and official remediation guidance.