Unlimited Elements For Elementor: PHP Object Injection via untrusted data

Summary

The WordPress plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) up to and including version 2.0.19 deserializes untrusted data, which allows PHP object injection. An attacker who can send crafted input to a vulnerable site may be able to manipulate how the server processes data and run harmful actions. Patchstack and CISA rate the issue as high severity (CVSS 8.8), but CISA reports no known exploitation at publication. The attacker needs a low-privilege account, so exposure depends on whether user registration is open or accounts can be compromised.

Affected

• Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin, versions up to and including 2.0.19
• CVSS 3.1: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), CWE-502

Fixed in

• Version 2.0.20 (Patchstack lists 2.0.20 as the patched version; the link to this CVE is not explicitly confirmed by the changelog)
• Later releases exist; installing the latest version is recommended

Workaround

• Unknown. No vendor or Patchstack workaround for this CVE was identified.
• Interim measures, if an update is not possible immediately: restrict or disable user registration, review subscriber and contributor accounts, and check for suspicious accounts.

Exploitation

• CISA SSVC at publication: Exploitation none, Automatable no, Technical Impact total.
• Patchstack describes the vulnerability as expected to be exploited and used in mass-exploit campaigns.
• No public proof of concept found. Remote code execution impact is unverified.

Our recommendation

• Check whether the plugin is installed on any WordPress site and identify the version.
• Update to the latest version, at least 2.0.20, as a high-priority task.
• If an update is not possible immediately, restrict user registration and review low-privilege accounts.
• Monitor the site for suspicious activity and check for compromise.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• OpenCVE record app.opencve.io
• VulDB entry vuldb.com
• WordPress.org plugin listing wordpress.org
• WordPress.org changelog en-ca.wordpress.org
• Vendor changelog unlimited-elements.com
• WPScan plugin listing wpscan.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:16.