Unlimited Elements CVE-2026-66608

Requires an authenticated WordPress account with at least Contributor role on a site running Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19; exploitation is remote over the network with no user interaction. The practical limiter is the Contributor authentication requirement (PR:L) - an attacker must be able to register or obtain such an account - which restricts this to insider abuse, sites allowing open Contributor registration, or a chained-credential scenario rather than fully anonymous attack. The specific triggering plugin feature/parameter is not disclosed in the advisory description.

This is a moderate, authentication-gated SSRF that should be triaged as medium priority rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, 6.4) confirms network reach, low complexity, and no user interaction, but PR:L means a valid Contributor account is required - an important limiting factor that keeps this out of unauthenticated-scanner territory. The scope change (S:C) is consistent with SSRF pivoting from the WordPress host to internal/other systems, though impacts are only Low across confidentiality and integrity with no availability impact, matching a constrained SSRF (limited response reflection / blind or partial rather than full internal resource read). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active exploitation or automation. There is no SSVC data supplied. Net: real but bounded - the value is as an insider/low-privilege-to-internal-pivot primitive, not a mass-exploitation crisis. Key gaps to note explicitly: no fixed version is stated in the EUVD/Patchstack data, and the specific vulnerable feature/parameter is not disclosed in the description, so remediation currently depends on the Patchstack advisory rather than a confirmed patched release.

An attacker who has (or registers/social-engineers) a Contributor account on a WordPress site running Unlimited Elements For Elementor <= 2.0.19 submits a crafted request through the vulnerable plugin functionality that causes the server to fetch an attacker-controlled or internal URL. This can be used to reach internal-only services, cloud metadata endpoints, or other hosts the WordPress server can see, achieving the low-level confidentiality/integrity impact and scope change reflected in the CVSS vector. No public exploit code was identified at time of analysis, so exploitation would require the attacker to develop the request themselves.