CVE-2026-85017
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. A partial fix in the 2.0.18 to 2.0.19 releases raised the privilege required to reach the vulnerable action to editor-level, and the issue was fully resolved in 2.0.20.
Risk Assessment
PHP object injection can lead to remote code execution or other severe impacts, and the low required privilege level increases the risk of exploitation.
Recommendation
Update the Unlimited Elements For Elementor plugin to version 2.0.20 or later.
Other vulnerabilities in Unlimited Elements For Elementor WordPress plugin
See all- CVE-2026-92923Unknown
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement. This allows users with a role as low as subscriber to perform blind SQL injection attacks and read arbitrary data from the database. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.
- CVE-2026-92924Medium
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it. This allows users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site; from version 2.0.18 onward the issue requires a Contributor role or above.
Original NVD description (English source)
The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. A partial fix in the 2.0.18 to 2.0.19 releases raised the privilege required to reach the vulnerable action to editor-level, and the issue was fully resolved in 2.0.20.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS