Unlimited Elements for Elementor EUVD-2026-114269

Exploitation requires an authenticated session on the target WordPress site: the CVSS vector specifies PR:L, so a low-privileged (authenticated) account is needed, which is the primary limiting factor. The affected software is the Unlimited Elements For Elementor plugin in versions up to and including 2.0.26, so a vulnerable version must be installed and active (and, being an Elementor add-on, Elementor is the deployment context). The specific feature, endpoint, or request parameter that controls the include filename is not described in the available sources; beyond the authentication requirement, no further non-default configuration is indicated (AC:L, UI:N), and impact is limited to disclosure of local file contents (C:H, I:N, A:N) with no integrity or availability effect.

This is a moderate-priority issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity flaw that requires some level of authentication (PR:L) and yields only a confidentiality impact (C:H, I:N, A:N) - consistent with a local file inclusion used for information disclosure rather than code execution. No EPSS score, no CISA KEV listing, and no confirmed public exploit were supplied, so there is no evidence of active or at-scale exploitation at this time. The only decision signal is the vuln.today priority label 'this_month', which aligns with a serious-but-not-critical authenticated disclosure bug. One cross-source note: the CWE is CWE-98 ('PHP Remote File Inclusion'), but the description and tags describe Local File Inclusion only, so treat the 'remote file inclusion' classification as a labeling artifact rather than confirmation that remote URLs can be included. Overall this is a real but second-tier issue: high confidentiality impact on a widely used WordPress plugin, tempered by the authentication requirement and the absence of any exploitation or PoC evidence.

An attacker who already holds a low-privileged authenticated account on a WordPress site running this plugin sends a crafted request that manipulates a filename passed to a PHP include/require statement. Because the filename is not properly controlled, the server includes an unintended local file and returns its contents, disclosing sensitive data such as configuration or credential files. No public exploit code was identified at the time of analysis, and exploitation requires network access plus valid authentication.