CVSS v3
8.8
HIGH
EPSS Score
17.5%
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executable PHP code via the PHP Raw snippet. NOTE: this issue can be mitigated by removing the Dynamic OOO widget or by restricting availability of the Editor role.
The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executable PHP code via the PHP Raw snippet. NOTE: this issue can be mitigated by removing the Dynamic OOO widget or by restricting availability of the Editor role.
Active exploitation of CVE-2020-26596 has not been confirmed. The EPSS score is 17.5%, indicating the estimated probability of exploitation in the next 30 days.
CVE-2020-26596 has a CVSS v3 base score of 8.8 (HIGH severity).
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
Ranked by exploit probability (EPSS).