CVE-2026-28146: WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability

Published Aug 6, 2026

Updated

Contributor Arbitrary File Download in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.14 versions.

Affected Software

1 affected component

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin<=2.0.14

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to a version that resolves this vulnerability.
Fixed in 2.0.15

Aug 6, 2026

CVE Published

via MITRE·02:27 PM

Data Sourced

via MITRE·02:27 PM

RemedyDescriptionSeverityWeakness

The severity of CVE-2026-28146 is medium with a score of 6.5.

To fix CVE-2026-28146, update the Unlimited Elements For Elementor plugin to version 2.0.15 or later.

CVE-2026-28146 is an Arbitrary File Download vulnerability caused by path traversal.

Any WordPress site using the Unlimited Elements For Elementor plugin version 2.0.14 or earlier is affected by CVE-2026-28146.

Exploitation of CVE-2026-28146 could lead to unauthorized access to sensitive files on the server.