What is the CVSS score of CVE-2026-28147?

CVE-2026-28147 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Unlimited Elements For Elementor CVE-2026-28147

EUVD-2026-52227 MEDIUM

Missing Authorization (CWE-862)

2026-08-03 Patchstack

GHSA-crjc-75c2-rpr6

WordPress Authentication Bypass Unlimited Elements For Elementor Free Widgets Addons Templates Wordpress Plugin Unlimited Elements

5.4

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

Network-reachable WordPress endpoint requiring only a low-privilege account; no confidentiality impact, only limited integrity and availability disruption within plugin scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 08:20 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.15.

AnalysisAI

Broken access control in the Unlimited Elements For Elementor WordPress plugin (versions through 2.0.15) permits authenticated low-privileged users to invoke restricted plugin functions without proper authorization. The flaw, rooted in CWE-862 (Missing Authorization), allows a subscriber- or contributor-level WordPress account to perform actions that should be restricted to higher-privileged roles, resulting in low-impact integrity and availability consequences. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The affected product is the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin, identified by CPE cpe:2.3:a:unlimited_elements:unlimited_elements_for_elementor_(free_widgets,_addons,_templates):*:*:*:*:*:*:*:*. CWE-862 (Missing Authorization) describes a pattern where the application does not verify that the authenticated user holds sufficient permission before executing a sensitive operation. In WordPress plugins, this typically manifests as AJAX handlers, REST API endpoints, or admin-post actions that check only for authentication (is_user_logged_in) rather than capability checks (current_user_can). The plugin extends Elementor's page-builder with additional widgets, templates, and addons, meaning the vulnerable actions likely touch widget management, template import/export, or addon configuration - functions that should be restricted to editors or administrators.

RemediationAI

Update the Unlimited Elements For Elementor plugin to a version beyond 2.0.15 as soon as the vendor releases a patched build; the exact patched version is not independently confirmed in available data, so administrators should check the WordPress plugin repository changelog or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/unlimited-elements-for-elementor/vulnerability/wordpress-unlimited-elements-for-elementor-free-widgets-addons-templates-plugin-2-0-15-broken-access-control-vulnerability for the confirmed fix version. As an interim compensating control, disable open user registration (Settings > General > 'Anyone can register') to remove the low-privilege account vector available to untrusted users - this limits exploitation to already-trusted accounts, significantly reducing realistic risk. If the plugin is not actively needed, deactivating and removing it eliminates the attack surface entirely with no functional trade-off for sites not using Elementor widgets from this addon.