PT-2026-33414 · WordPress · Unlimited Elements For Elementor

Dmitry Ignatyev · Published 2026-04-17 · Updated 2026-05-02 · CVE-2026-4659

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Unlimited Elements for Elementor versions prior to 2.0.7

Description An arbitrary file read issue exists due to insufficient path traversal sanitization in the URLtoRelative() and urlToPath() functions, combined with the ability to enable debug output in widget settings. The URLtoRelative() function removes the site base URL but fails to sanitize path traversal sequences (../), while the cleanPath() function normalizes directory separators without removing traversal components. This allows authenticated attackers with Author-level access and above to read arbitrary local files from the WordPress host, such as wp-config, by providing a crafted URL in the 'Repeater JSON/CSV URL' parameter.

Recommendations Update the plugin to a version later than 2.0.6.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-4659

Affected Products

Unlimited Elements For Elementor

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2026-4659 · Security Note
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/tags/2.0.6/provider/provider_helper.class.php#L607 · Note
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/tags/2.0.6/inc_php/unitecreator_operations.class.php#L710 · Note
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_operations.class.php#L710 · Note
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_helper.class.php#L667 · Note
• https://twitter.com/VulmonFeeds/status/2045055796820451504 · Twitter Post
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/tags/2.0.6/inc_php/unitecreator_helper.class.php#L643 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/9e7e3763-4606-4fc4-aa0f-b67e6087bdc2?source=cve · Note
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_helper.class.php#L643 · Note
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/tags/2.0.6/inc_php/unitecreator_helper.class.php#L667 · Note
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/provider_helper.class.php#L607 · Note
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/tags/2.0.6/provider/provider_helper.class.php#L597 · Note
• https://twitter.com/HugoValters/status/2050674868073480431 · Twitter Post
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/provider_helper.class.php#L597 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3504458%40unlimited-elements-for-elementor&new=3504458%40unlimited-elements-for-elementor&sfp_email=&sfph_mail= · Note