Rometheme RomethemeKit For Elementor Code Injection Vulnerability Leading to Remote Code Execution

A code injection vulnerability allowing command execution has been identified in the Rometheme RomethemeKit For Elementor plugin, affecting versions through 1.5.4. This vulnerability arises from improper control over code generation, which could be exploited to execute arbitrary commands on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected website, potentially leading to unauthorized access and control over the site.

Remediation

Users of the Rometheme RomethemeKit For Elementor plugin should update to version 1.5.5 or later. Patchstack users can enable auto-update for vulnerable plugins.