Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Traversal
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature (Administrators by default, or Editors when a non-default Unlimited Elements for Elementor WordPress plugin before 2.0.21 setting is enabled) to write arbitrary files, including executable PHP, outside the intended upload directory on servers where the PHP zip extension is unavailable, leading to Remote Code Execution.
CVE-2026-85015
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-85015
Unlimited Elements for Elementor
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Unknown",
"product": "Unlimited Elements for Elementor",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.0.21",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-85015
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #8430 · Revision 1
- Added to Heist Feed
- Publisher date