Deserialization in Unlimited Elements For Elementor
CVE-2026-85017
The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. A partial fix in the 2.0.18 to 2.0.19 releases raised the privilege required to reach the vulnerable action to editor-level, and the issue was fully resolved in 2.0.20.
Vulnerability class: Insecure Deserialization
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Unknown Unlimited Elements For Elementor
Weakness classification (CWE)
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-85017?
- CVE-2026-85017 is a high-severity vulnerability in Unlimited Elements For Elementor, classified under Deserialization of Untrusted Data. CVSS score: 7.5/10. Published 2026-09-20.
- How severe is CVE-2026-85017?
- High severity. CVSS v3 base score is 7.5 out of 10.