EUVD-2026-83669
GHSA-3wpx-h7q2-mv8g
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Remote AJAX action reachable by any subscriber (AV:N/PR:L/UI:N); AC:H because full impact depends on an available POP gadget chain; object injection can yield C/I/A:H.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. A partial fix in the 2.0.18 to 2.0.19 releases raised the privilege required to reach the vulnerable action to editor-level, and the issue was fully resolved in 2.0.20.
Articles & Coverage 1
AnalysisAI
PHP object injection in the Unlimited Elements For Elementor WordPress plugin (versions before 2.0.20) lets authenticated attackers with subscriber-level access inject arbitrary PHP objects through an AJAX action that lacks a capability check and deserializes stored data. Exploitation requires open user registration (or any low-privilege account), and full impact-such as remote code execution or file/database manipulation-depends on a usable PHP POP gadget chain being loaded by WordPress core, Elementor, or another active plugin (hence the AC:H rating). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target site to (1) run Unlimited Elements For Elementor before 2.0.20 (versions 2.0.18-2.0.19 are only partially mitigated by an editor-level requirement, so subscriber exploitation there is blocked but editor+ is not), (2) allow the attacker to hold at least subscriber-level authentication - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine object-injection flaw with meaningful impact but tempered by real preconditions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Unlimited Elements For Elementor plugin to version 2.0.20 or later-this is the only version that fully removes the vulnerable deserialization path and capability-check gap. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress instances running Unlimited Elements For Elementor versions before 2.0.20 and apply the vendor-released patch 2.0.20; note that versions 2.0.18-2.0.19 only partially mitigate and are not sufficient. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today