CVE-2026-85015: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Unlimited Elements for Elementor
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature (Administrators by default, or Editors when a non-default Unlimited Elements for Elementor WordPress plugin before 2.0.21 setting is enabled) to write arbitrary files, including executable PHP, outside the intended upload directory on servers where the PHP zip extension is unavailable, leading to Remote Code Execution.
AI Analysis
Technical Summary
The Unlimited Elements for Elementor WordPress plugin before version 2.0.21 fails to properly sanitize file paths inside uploaded archives before extraction. Authenticated users with asset-management permissions (Administrators by default, or Editors if configured) can exploit this vulnerability when the PHP zip extension is not present on the server. By leveraging this, attackers can write arbitrary files, including executable PHP scripts, outside the designated upload directory, potentially resulting in remote code execution.
Potential Impact
Successful exploitation allows authenticated users with specific plugin permissions to write arbitrary files anywhere on the server, including executable PHP files. This can lead to remote code execution, compromising the server hosting the WordPress site.
Mitigation Recommendations
Upgrade the Unlimited Elements for Elementor plugin to version 2.0.21 or later, where this vulnerability is fixed. No other mitigations are specified. Since this is a plugin vulnerability, patching the plugin is the recommended remediation.
CVE-2026-85015: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Unlimited Elements for Elementor
Description
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature (Administrators by default, or Editors when a non-default Unlimited Elements for Elementor WordPress plugin before 2.0.21 setting is enabled) to write arbitrary files, including executable PHP, outside the intended upload directory on servers where the PHP zip extension is unavailable, leading to Remote Code Execution.
CVSS v3.1
Score 6.6medium
Affected software
Unlimited Elements for Elementor
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Unlimited Elements for Elementor WordPress plugin before version 2.0.21 fails to properly sanitize file paths inside uploaded archives before extraction. Authenticated users with asset-management permissions (Administrators by default, or Editors if configured) can exploit this vulnerability when the PHP zip extension is not present on the server. By leveraging this, attackers can write arbitrary files, including executable PHP scripts, outside the designated upload directory, potentially resulting in remote code execution.
Potential Impact
Successful exploitation allows authenticated users with specific plugin permissions to write arbitrary files anywhere on the server, including executable PHP files. This can lead to remote code execution, compromising the server hosting the WordPress site.
Mitigation Recommendations
Upgrade the Unlimited Elements for Elementor plugin to version 2.0.21 or later, where this vulnerability is fixed. No other mitigations are specified. Since this is a plugin vulnerability, patching the plugin is the recommended remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-02T19:18:43.920Z
- State
- PUBLISHED
Threat ID: 6ac11723a43b0b3b89cacf67
Added to database: 10/03/2026, 14:54:27 UTC
Last enriched: 10/03/2026, 14:56:28 UTC
Last updated: 10/04/2026, 04:34:29 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.