The CVSS 6.6 rating for this CVE significantly understates the risk in WordPress Multisite deployments. On single-site WordPress, administrators already have documented paths to arbitrary code execution through plugin upload and theme editing, so this vulnerability adds little practical privilege. But in Multisite, sub-site administrators are explicitly excluded from manage_options and cannot normally execute code—this vulnerability creates an undocumented bypass of the isolation model that Multisite depends on. A non-super admin on a subsite can leverage this to achieve server-level execution that the platform was designed to prevent. If you manage a WordPress network, treat this as a privilege escalation vulnerability in multisite contexts, not a simple RCE.
The technical mechanism reveals a design pattern worth studying as an anti-pattern. The plugin writes custom widget markup to a PHP file and then executes that file—a dynamic code generation pipeline where user input crosses into executable context. This pattern suggests either an unsafe caching implementation or a live preview feature that prioritized workflow friction reduction over security boundaries. The attempted sanitization was insufficient because it addressed output sanitization rather than execution context sanitization—these are different operations with different boundary conditions, and conflating them produces a false sense of protection.
This is not an isolated failure. The file-write-then-execute pattern recurs across WordPress plugin history because page builder economics create pressure for frictionless, instant editing experiences, which pushes developers toward bypassing normal rendering pipelines and writing directly into executable contexts. WordPress offers no safe primitive for dynamic content preview without risking code execution, so developers build unsafe alternatives themselves.
For defenders: prioritize patching Multisite installations immediately—this is your highest-risk exposure. On single-site, the incremental risk over existing admin capabilities is low. Audit your environment for abandoned or unmaintained Elementor extensions; this pattern is more dangerous when the plugin is no longer being monitored. After patching, verify that no malicious PHP files were written to disk during the vulnerable window—a patch that removes the write path does not clean up previously planted files.