The Unlimited Elements for Elementor plugin suffers from a CWE-22 path traversal vulnerability due to inadequate sanitization in the URLtoRelative() and urlToPath() functions. These functions fail to properly remove or neutralize '../' sequences in URLs, allowing an attacker to craft a URL that resolves to arbitrary files on the server filesystem. Authenticated users with Author-level privileges or higher can exploit this by supplying a specially crafted Repeater JSON/CSV URL parameter, potentially reading sensitive files like /etc/passwd or wp-config.php. The vulnerability exists in versions up to and including 2.0.6. No official patch or remediation guidance is currently available from the vendor.

An attacker with Author-level or higher access can read arbitrary local files on the WordPress host, including sensitive configuration files. This can lead to disclosure of credentials, configuration secrets, or other sensitive data stored on the server. The CVSS score of 7.5 reflects a high severity due to the confidentiality impact and the relatively low complexity of exploitation given the required privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and consider disabling the debug output feature in widget settings if possible to reduce exposure. Monitor vendor channels for updates and apply patches promptly once released.