This vulnerability (CVE-2026-27041) in Studio Keren Aga LTD.'s Unlimited Elements for Elementor (Premium) plugin versions up to 2.0.6 permits users with contributor privileges to upload files of dangerous types without restriction. Such arbitrary file upload vulnerabilities can enable attackers to execute malicious code, escalate privileges, or disrupt service. The CVSS 3.1 base score of 9.9 reflects its critical impact with network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and complete impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed as of the publication date.

Successful exploitation allows an attacker with contributor-level access to upload arbitrary files, potentially leading to remote code execution, full system compromise, data theft, or denial of service. The vulnerability affects confidentiality, integrity, and availability severely, as indicated by the CVSS score of 9.9.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor permissions or disable file upload functionality for contributors if possible to mitigate risk.