What is the CVSS score of CVE-2026-27041?

CVE-2026-27041 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Unlimited Elements for Elementor are affected by CVE-2026-27041?

Unlimited Elements for Elementor (Premium) plugin versions 2.0.6 and earlier contain a critical file upload vulnerability allowing authenticated Contributor-level users to execute arbitrary code on…

How to fix or mitigate CVE-2026-27041?

Within 24 hours: Audit WordPress installations for Unlimited Elements for Elementor (Premium) v2.0.6 or earlier; restrict creation of new Contributor accounts and document all existing contributors. Within 7 days: Enable logging on wp-content/uploads directory; monitor for suspicious PHP or executable file uploads; consider plugin disablement if contributors cannot be fully removed. Within 30 days: Subscribe to Patchstack and Unlimited Elements vendor advisories for patch announcement; deploy patch immediately upon availability or remove the plugin entirely and migrate to an alternative solution.

Unlimited Elements for Elementor CVE-2026-27041

EUVD-2026-37668 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-06-17 Patchstack

File Upload Unlimited Elements For Elementor Premium Elementor

9.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable plugin endpoint (AV:N), no special conditions (AC:L), requires Contributor auth (PR:L), no user interaction (UI:N); arbitrary PHP upload yields RCE on the WordPress host beyond the plugin scope (S:C, C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:26 vuln.today

DescriptionCVE.org

Contributor Arbitrary File Upload in Unlimited Elements for Elementor (Premium) <= 2.0.6 versions.

AnalysisAI

Arbitrary file upload in the Unlimited Elements for Elementor (Premium) WordPress plugin versions 2.0.6 and earlier allows authenticated users with Contributor-level privileges to upload arbitrary files, leading to remote code execution on the underlying WordPress host. Reported by Patchstack and rated CVSS 9.9 with a scope-changing impact, no public exploit identified at time of analysis but the low privilege bar makes this a high-priority issue for any site that permits Contributor accounts.

Technical ContextAI

The affected component is the Premium edition of the Unlimited Elements for Elementor WordPress plugin (CPE: studio_keren_aga_ltd.:unlimited_elements_for_elementor_(premium)), a widget/template add-on for the Elementor page builder. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type) - server-side handlers exposed to authenticated low-privilege users fail to validate file type/extension/content, permitting upload of executable PHP into a web-accessible directory. Because WordPress evaluates PHP in the uploads or plugin directory tree, a single uploaded file is enough to pivot to code execution under the web server user.

RemediationAI

Patch available per vendor advisory - consult the Patchstack entry at https://patchstack.com/database/wordpress/plugin/unlimited-elements-for-elementor-premium/vulnerability/wordpress-unlimited-elements-for-elementor-premium-plugin-1-4-72-arbitrary-file-upload-vulnerability for the exact fixed release and upgrade Unlimited Elements for Elementor (Premium) beyond 2.0.6 on every WordPress site that uses it. As a compensating control until patched, disable or deactivate the Unlimited Elements for Elementor (Premium) plugin (impact: any pages depending on its widgets will render broken), tighten WordPress role management to remove Contributor accounts from untrusted users and disable open self-registration (trade-off: blocks guest contributors), and add a WAF rule or hardening such as Patchstack/Wordfence virtual patching plus a deny-execute rule on wp-content/uploads (e.g., a directory-level configuration preventing PHP execution under uploads), accepting that the deny-execute rule can break legitimate plugins that intentionally place executable assets there.