Unlimited Elements CVE-2026-62023

Requires an authenticated account with at least low-level privileges (PR:L in the CVSS vector), such as a subscriber on a site permitting open user registration; it is not exploitable by anonymous/unauthenticated visitors. The affected component is reachable over the network (AV:N) with low attack complexity (AC:L) and needs no user interaction (UI:N). The specific plugin feature, configuration setting, or endpoint that lacks the authorization check is not described in the available sources. Exploitation is limited to installations running Unlimited Elements For Elementor at or before version 2.0.26, and impact is confined to confidentiality (read-only exposure); no integrity or availability effect is indicated.

This is a moderate-severity Missing Authorization / Broken Access Control flaw (CWE-862) in the Unlimited Elements For Elementor WordPress plugin, rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The signals are internally consistent and point to a limited-impact issue rather than a top-priority emergency: the vector is network-reachable with low complexity but requires low-level authentication (PR:L, i.e. an existing authenticated account such as subscriber/contributor), and impact is confined to a low confidentiality breach only (C:L, I:N, A:N) with no scope change. The vuln.today decision label is 'this_month' - a routine patch-cycle priority, not act_now/emergency. No CISA KEV listing and no EPSS score were provided, and there is no public exploit identified at time of analysis (the single reference is a Patchstack advisory entry, not exploit code). The combination of required authentication, low confidentiality-only impact, and absence of exploitation evidence means this is a genuine but low-to-moderate priority issue - best handled in a normal update cycle rather than as an urgent out-of-band response. Note: no EPSS, KEV, or SSVC automatable/technical-impact data was supplied, so the real-world exploitation-probability dimension cannot be assessed from the input.

An attacker who already holds a low-privilege authenticated account (for example a subscriber on a site that allows open registration) sends a request to a plugin function that fails to enforce a proper capability/authorization check, gaining read access to data they should not be able to view. No public exploit code is identified at time of analysis, and the exact triggering function is not described in the available sources. Because the CVSS vector is PR:L, exploitation requires authentication and is not achievable by a fully anonymous visitor.