CVE-2026-85015: Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Traversal

Q: Which users can exploit this issue under the default configuration?

By default, exploitation requires an authenticated Administrator account with access to the plugin's asset-management feature. Editors are also exposed only if a non-default plugin setting enables their access to that feature.

Q: What server condition is required for remote code execution?

The server must lack the PHP zip extension. Under that condition, a crafted uploaded archive can write files outside the intended upload directory, including executable PHP files.

Q: What should be prioritized for remediation?

Update the plugin to version 2.0.21 or later. Until updating is possible, restrict access to the plugin's asset-management feature to trusted administrators and do not enable Editor access to it.

Published Oct 3, 2026

Updated

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature (Administrators by default, or Editors when a non-default Unlimited Elements for Elementor WordPress plugin before 2.0.21 setting is enabled) to write arbitrary files, including executable PHP, outside the intended upload directory on servers where the PHP zip extension is unavailable, leading to Remote Code Execution.

Affected Software

1 affected component

Unlimited Elements Unlimited Elements for Elementor WordPress plugin<2.0.21

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Unlimited Elements for Elementor WordPress plugin to a version that resolves this vulnerability.
Fixed in 2.0.21

Event History

Oct 3, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue under the default configuration?

By default, exploitation requires an authenticated Administrator account with access to the plugin's asset-management feature. Editors are also exposed only if a non-default plugin setting enables their access to that feature.

What server condition is required for remote code execution?

The server must lack the PHP zip extension. Under that condition, a crafted uploaded archive can write files outside the intended upload directory, including executable PHP files.

What should be prioritized for remediation?

Update the plugin to version 2.0.21 or later. Until updating is possible, restrict access to the plugin's asset-management feature to trusted administrators and do not enable Editor access to it.

CVE-2026-85015: Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Traversal

Affected Software

Remediation

Event History

Frequently Asked Questions

Which users can exploit this issue under the default configuration?

What server condition is required for remote code execution?

What should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue under the default configuration?

What server condition is required for remote code execution?

What should be prioritized for remediation?