Unlimited Elements For Elementor CVE-2026-28147

Exploitation requires the attacker to hold a low-privileged authenticated WordPress account (PR:L per CVSS), such as a subscriber or contributor role. The target site must have the Unlimited Elements For Elementor plugin installed and active at version 2.0.15 or below. Open user registration on the WordPress site (Settings > General) further lowers the bar by allowing untrusted parties to self-provision the required account. Sites where user registration is closed limit exploitation to already-authenticated users with at least subscriber access. No network-level or firewall restriction prevents exploitation since the attack is conducted over standard HTTPS to the WordPress installation's endpoints (AV:N, AC:L).

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L yields a Medium score of 5.4. The attack is network-reachable with low complexity and requires only a low-privilege authenticated account - meaning any registered WordPress user (subscriber or above) can trigger the flaw without user interaction. However, the scope is unchanged and both integrity and availability impacts are rated low, indicating the attacker cannot achieve full site compromise or data exfiltration directly through this vector alone. No EPSS data was supplied, and the vulnerability is absent from CISA KEV, which is consistent with its medium severity profile. The practical risk is elevated on sites with open user registration, where untrusted individuals can obtain the low-privilege account required for exploitation. The risk is constrained on sites where self-registration is disabled and user accounts are tightly controlled.

An attacker registers a subscriber-level account on a WordPress site with open registration enabled and the vulnerable plugin installed. The attacker then crafts a direct HTTP request to a plugin AJAX or REST endpoint that performs a privileged action - such as importing a template or modifying widget configuration - without supplying elevated credentials. Because the authorization check is missing, the server processes the request and applies the unauthorized change, potentially defacing content or disrupting plugin functionality.