Unlimited Elements For Elementor CVE-2026-28146

Exploitation requires the attacker to possess at minimum a WordPress Contributor-level account on the target site, as confirmed by CVSS PR:L - unauthenticated exploitation is explicitly not indicated. The Unlimited Elements For Elementor plugin must be installed and active at version 2.0.14 or earlier. No non-default plugin configuration or special server-side setup is required beyond the plugin being present and active. Exploitation is bounded by the need for authenticated access: sites that disable public user registration, require administrator approval for new accounts, and grant the Contributor role only to verified individuals materially reduce exposure. The attack is fully network-executable (AV:N) with low complexity (AC:L) once Contributor credentials are in hand.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N scores 6.5 (Medium), reflecting network-reachable exploitation with low attack complexity, requiring only Contributor-level WordPress authentication and no user interaction. The high confidentiality impact (C:H) is the dominant risk driver - exposure of wp-config.php or .env files can yield database credentials enabling full site compromise, making this effectively a stepping stone to a broader breach despite the absence of direct integrity or availability impact. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread exploitation campaign. No public POC has been identified. However, path traversal against WordPress plugins is a well-understood attack class requiring minimal skill once authentication is obtained, and Contributor accounts are frequently obtainable via open registration or social engineering on content-driven sites. The real-world risk is moderate-to-high for sites that permit open Contributor registration or have untrusted contributors.

An attacker obtains or registers a WordPress Contributor account on the target site, then submits a crafted HTTP request to the vulnerable plugin endpoint embedding a path traversal payload (e.g., '../../../../wp-config.php') in a file parameter. The plugin returns the contents of the requested file without validation, exposing the site's database credentials. No public POC has been identified at time of analysis, but the technique is well-understood and independently reproducible by attackers familiar with WordPress plugin path traversal patterns.