This vulnerability (CVE-2026-65549) affects Jeg Kit for Elementor versions <= 3.2.10 and is caused by unsafe deserialization of untrusted data, leading to PHP Object Injection. The CVSS v3.1 score is 7.2, indicating a high severity with network attack vector, low attack complexity, requiring high privileges but no user interaction. Successful exploitation can result in full compromise of confidentiality, integrity, and availability of the affected system. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

Exploitation of this vulnerability can allow an attacker with high privileges to execute arbitrary code or manipulate application logic via PHP Object Injection. This results in a complete compromise of confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected application to trusted users only and monitor for suspicious activity related to deserialization processes.