What is the CVSS score of CVE-2026-4659?

CVE-2026-4659 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-4659?

Unlimited Elements for Elementor WordPress plugin versions 2.0.6 and earlier contains a path traversal vulnerability allowing authenticated users with Author-level access to read arbitrary files from…

How to fix or mitigate CVE-2026-4659?

Within 24 hours: Identify all WordPress instances using Unlimited Elements for Elementor and document current installed version. Within 7 days: Restrict Author-level user capabilities in WordPress admin settings and review user roles to minimize exposure; consider disabling the Repeater JSON/CSV URL parameter feature if functionality permits. Within 30 days: Monitor vendor advisory channels for patch release; when available, immediately upgrade to patched version (currently no fixed version identified-apply vendor patch upon release).

WordPress CVE-2026-4659

EUVD-2026-23380 HIGH

Path Traversal (CWE-22)

2026-04-17 Wordfence

Path Traversal WordPress Elementor

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 17, 2026 - 07:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 17, 2026 - 07:22 vuln.today

cvss_changed

Analysis Generated

Apr 17, 2026 - 07:13 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 07:00 euvd

EUVD-2026-23380

Analysis Generated

Apr 17, 2026 - 07:00 vuln.today

CVE Published

Apr 17, 2026 - 06:44 nvd

HIGH 7.5

DescriptionCVE.org

The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Arbitrary File Read via the Repeater JSON/CSV URL parameter in versions up to, and including, 2.0.6. This is due to insufficient path traversal sanitization in the URLtoRelative() and urlToPath() functions, combined with the ability to enable debug output in widget settings. The URLtoRelative() function only performs a simple string replacement to remove the site's base URL without sanitizing path traversal sequences (../), and the cleanPath() function only normalizes directory separators without removing traversal components. This allows an attacker to provide a URL like http://site.com/../../../../etc/passwd which, after URLtoRelative() strips the domain, results in /../../../../etc/passwd being concatenated with the base path and ultimately resolved to /etc/passwd. This makes it possible for authenticated attackers with Author-level access and above to read arbitrary local files from the WordPress host, including sensitive files such as wp-config.

AnalysisAI

Path traversal in Unlimited Elements for Elementor (WordPress plugin ≤2.0.6) enables authenticated attackers with Author-level privileges to read arbitrary files from the web server via crafted URLs in the Repeater JSON/CSV URL parameter. The vulnerability chains multiple sanitization failures in URLtoRelative(), urlToPath(), and cleanPath() functions, allowing traversal sequences like ../../../../etc/passwd to bypass domain-stripping logic and access sensitive files including wp-config.php. CVSS 7.5 indicates high confidentiality impact. EPSS and KEV data not provided; no public exploit confirmed at time of analysis. Wordfence reports the issue with detailed code references to vulnerable functions in versions through 2.0.6.

Technical ContextAI

This vulnerability affects the Unlimited Elements for Elementor plugin (CPE: cpe:2.3:a:unitecms:unlimited_elements_for_elementor), a popular WordPress page builder extension. The flaw manifests in the Repeater widget's handling of external JSON/CSV data sources. When processing URLs, the URLtoRelative() function performs simple string replacement to strip the site's base URL without validating the resulting path. The cleanPath() function normalizes directory separators (converting backslashes to forward slashes) but fails to remove or block traversal components (../ sequences). After URLtoRelative() processes a crafted input like http://site.com/../../../../etc/passwd, it produces /../../../../etc/passwd, which is then concatenated with the WordPress base path. PHP's file system functions resolve these traversal sequences, allowing escape from the intended directory. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), a classic path traversal weakness. The attack surface expands when debug output is enabled in widget settings, potentially revealing file contents directly in the WordPress admin interface. The references point to specific vulnerable code in unitecreator_operations.class.php (line 710), unitecreator_helper.class.php (lines 643, 667), and provider_helper.class.php (lines 597, 607), providing precise remediation targets for developers.

RemediationAI

Update Unlimited Elements for Elementor to version 2.0.7 or later, as changeset 3504458 (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3504458%40unlimited-elements-for-elementor&new=3504458%40unlimited-elements-for-elementor) indicates a patch addressing path traversal issues in the affected functions. Verify the installed version in WordPress admin under Plugins and apply updates immediately. If immediate patching is not possible, implement these compensating controls: (1) Restrict Author-level role assignments to only fully trusted users, limiting the pool of potential attackers. (2) Disable debug output in all Unlimited Elements widget settings, as debug mode is required to exfiltrate file contents. (3) Configure PHP's open_basedir directive in php.ini to restrict file system access to the WordPress installation directory and temporary upload paths, preventing traversal to /etc, /root, or other sensitive system directories (note: this may break legitimate plugins that access files outside the web root). (4) Review WordPress user accounts and revoke Author+ capabilities from non-essential users. (5) Monitor web server logs for unusual file access patterns or repeated requests to widget endpoints with URL parameters containing traversal sequences. These workarounds reduce attack surface but do not eliminate the underlying vulnerability; patching remains the definitive solution.