CVE-2024-2662 is an OS command injection vulnerability (CWE-78) affecting the Unlimited Elements For Elementor plugin for WordPress. The issue arises from improper neutralization of special elements in template attributes during HTML generation for custom widgets. Authenticated attackers with administrator or higher privileges can exploit this to execute arbitrary OS commands on the hosting server. The vulnerability affects all versions up to and including 1.5.102. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with administrator-level access to execute arbitrary operating system commands on the server hosting the WordPress site. This can lead to full compromise of the server, including data theft, service disruption, and further lateral movement. The impact is rated high due to the potential for complete system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity. Avoid using affected plugin versions. No vendor advisory or patch links are currently provided, so remain vigilant for updates from the vendor or security community.