What is the CVSS score of CVE-2026-28146?

CVE-2026-28146 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Unlimited Elements For Elementor CVE-2026-28146

EUVD-2026-53946 MEDIUM

Path Traversal (CWE-22)

2026-08-06 Patchstack

GHSA-rc6c-xxc7-jg93

WordPress Path Traversal Unlimited Elements For Elementor Free Widgets Addons Templates Wordpress Plugin Unlimited Elements

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible path traversal requiring only Contributor authentication (PR:L); arbitrary file read yields high confidentiality impact with no write or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:59 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

MEDIUM 6.5

DescriptionCVE.org

Contributor Arbitrary File Download in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.14 versions.

AnalysisAI

Arbitrary file download via path traversal in the Unlimited Elements For Elementor WordPress plugin (versions ≤ 2.0.14) allows authenticated Contributor-level users to retrieve arbitrary files from the server filesystem. Exploitation requires only low-privilege WordPress credentials and no user interaction, with high confidentiality impact - sensitive files such as wp-config.php containing database credentials are directly at risk. No public exploit or active exploitation has been confirmed at time of analysis, but the low attack complexity and broad deployment of Elementor-based WordPress sites elevates the practical urgency of patching.

Technical ContextAI

The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal), a class of flaw where user-supplied input is used to construct filesystem paths without sufficient sanitization. By injecting traversal sequences such as '../', an attacker can escape the plugin's intended working directory and reference arbitrary files on the server. The affected software, identified by CPE cpe:2.3:a:unlimited_elements:unlimited_elements_for_elementor_(free_widgets,_addons,_templates):*:*:*:*:*:*:*:*, is a WordPress plugin that extends the Elementor page builder with widgets, addons, and templates. The vulnerability exists within the plugin's file-handling functionality, which fails to validate or canonicalize the requested path before serving file contents to the requester.

RemediationAI

Update the Unlimited Elements For Elementor plugin to a version beyond 2.0.14 as soon as a patched release is available; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/unlimited-elements-for-elementor/vulnerability/wordpress-unlimited-elements-for-elementor-free-widgets-addons-templates-plugin-2-0-14-arbitrary-file-download-vulnerability and the WordPress plugin repository for the confirmed fixed version, as the exact patched release number is not independently confirmed from available data. As an immediate compensating control, restrict Contributor-role assignment to only fully trusted users and disable open user registration if not required, since exploitation mandates at minimum Contributor-level credentials - this directly eliminates the attack surface for external threat actors. Deploying a WAF rule to block path traversal patterns (sequences containing '../' or encoded equivalents) targeting plugin file-serving endpoints can reduce exploitation risk, though this may require tuning to avoid breaking legitimate plugin functionality. Review server-side file permissions to ensure the web process cannot read sensitive files outside the web root where possible.