CVE-2020-26596: 
WordPress vulnerability analysis and mitigation

The Dynamic OOO widget for the Elementor Pro plugin through version 3.0.5 for WordPress contains a critical vulnerability (CVE-2020-26596) that allows remote authenticated users with Editor privileges to execute arbitrary code. The vulnerability exists because only the Editor role is needed to upload executable PHP code via the PHP Raw snippet (NVD).

The vulnerability has a CVSS v3.1 Base Score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The issue stems from improper privilege management (CWE-269) where users with Editor role permissions can upload and execute PHP code through the PHP Raw snippet functionality in the Dynamic OOO widget (NVD, WPScan).

The vulnerability allows authenticated users with Editor privileges to execute arbitrary PHP code on the affected WordPress installation, potentially leading to complete system compromise with high impacts on confidentiality, integrity, and availability of the system (NVD).

The vulnerability is exploitable by authenticated users with Editor role privileges. Proof of concept code exists demonstrating how an attacker can exploit this vulnerability through the WordPress admin interface using the PHP Raw widget functionality (WPScan).

The vulnerability can be mitigated by either removing the Dynamic OOO widget or by restricting availability of the Editor role. The issue has been patched in Elementor Pro version 3.0.6 and later releases. Users are advised to update to the latest version (NVD, Elementor Changelog).