Unlimited Elements CVE-2026-103341

Requires only that a target WordPress site run the Unlimited Elements For Elementor plugin at version 2.0.20 or earlier; the vulnerable access-control-deficient endpoint is reachable by unauthenticated remote attackers against default configurations (AV:N/PR:N/UI:N/AC:L). The main limiting factors are the plugin being installed and active, and the modest C:L-only impact - the flaw discloses or exposes limited restricted data/functionality rather than granting write access, code execution, or full data compromise. No specific non-default setting or user interaction is indicated as required.

All signals point to a genuine but low-severity issue rather than a high-priority emergency. The vendor (Patchstack) CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N scores 5.3 (Medium), and my independent assessment agrees: network-reachable, no privileges, no user interaction, but the only impact is low-level confidentiality (C:L), with no integrity or availability effect. CWE-862 (Missing Authorization) describes a broken access-control endpoint that exposes some restricted data or functionality to unauthenticated callers. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation. The unauthenticated, low-complexity nature (PR:N/AC:L) means the barrier to exploitation is low if a working request is found, but the limited C:L-only impact keeps real-world risk modest. No conflicting signals between the vector and the description were detected - both consistently describe unauthenticated access-control bypass with limited confidentiality consequences.

An unauthenticated attacker sends a crafted HTTP request directly to an AJAX or REST action exposed by the plugin that fails to verify the caller's authorization level. Because no login or user interaction is required (PR:N/UI:N), the attacker retrieves restricted information or invokes a protected function that should have been gated behind a capability check. No public exploit code was identified at time of analysis.