CVE-2026-85304: CWE-862 Missing Authorization in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

The vulnerability identified as CVE-2026-85304 in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is classified as CWE-862 (Missing Authorization). It allows attackers to bypass access control mechanisms due to incorrect configuration, potentially enabling unauthorized actions within the plugin. The affected versions include all versions through 2.0.17. There is no vendor advisory or patch information available at this time, and no known exploits are reported in the wild.

The impact of this vulnerability is limited to unauthorized access due to missing authorization checks. According to the CVSS vector, the vulnerability can be exploited remotely without privileges or user interaction, resulting in limited confidentiality impact but no integrity or availability impact. This means an attacker could gain some unauthorized access or information but cannot modify data or disrupt service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific mitigation steps are provided by the vendor at this time.