Unlimited Elements CVE-2026-85017

Requires the target site to (1) run Unlimited Elements For Elementor before 2.0.20 (versions 2.0.18-2.0.19 are only partially mitigated by an editor-level requirement, so subscriber exploitation there is blocked but editor+ is not), (2) allow the attacker to hold at least subscriber-level authentication - i.e. open user registration or any low-priv account, and (3) have a usable PHP POP gadget chain loaded in WordPress core, Elementor, or another active plugin for the injected object to achieve code execution or file/DB impact. Limiting factors: authentication is required (PR:L, not fully unauthenticated), and the AC:H rating reflects the non-trivial dependency on an available gadget chain; no user interaction is needed once those conditions hold.

This is a genuine object-injection flaw with meaningful impact but tempered by real preconditions. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.5 High) reflects the core issue: an unauthenticated capability gap on an AJAX action lets a low-privilege subscriber reach a CWE-502 unserialize() of attacker-controlled data. The C:H/I:H/A:H triad is only realized if a usable POP gadget chain is available in the plugin, Elementor, WordPress core, or another loaded plugin - which is precisely why the vendor and NVD assign AC:H rather than AC:L. POC code is publicly available (WPScan), which raises real-world risk above a purely theoretical rating, but there is no CISA KEV listing and no EPSS score supplied, so this is 'publicly available exploit code exists' - NOT confirmed active exploitation. Exploitation status should be read as opportunistic/researcher-grade rather than mass-weaponized. Net: a real priority for sites running the plugin (subscriber registration is common on WordPress), but the AC:H gadget-chain dependency and lack of KEV/EPSS signals argue for prompt patching rather than emergency response. Note the phased fix is important context - 2.0.18-2.0.19 only raised the bar to editor-level (partial mitigation), and full resolution is 2.0.20; sites on the interim versions are only partially protected.

An attacker self-registers as a subscriber on a WordPress site running a vulnerable Unlimited Elements For Elementor version, then invokes the unprotected AJAX action to feed a crafted serialized PHP object into the plugin's unserialize() sink. If a suitable POP gadget chain is present in the loaded code, the injected object triggers file writes, SQL, or code execution leading to full site compromise. A public POC from WPScan demonstrates the deserialization path, lowering the practical skill barrier.