CVE-2026-85015: Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Traversal
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature (Administrators by default, or Editors when a non-default Unlimited Elements for Elementor WordPress plugin before 2.0.21 setting is enabled) to write arbitrary files, including executable PHP, outside the intended upload directory on servers where the PHP zip extension is unavailable, leading to Remote Code Execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Unlimited Elements for Elementor WordPress pluginto a version that resolves this vulnerability.Fixed in 2.0.21
Event History
Frequently Asked Questions
Which users can exploit this issue under the default configuration?
By default, exploitation requires an authenticated Administrator account with access to the plugin's asset-management feature. Editors are also exposed only if a non-default plugin setting enables their access to that feature.
What server condition is required for remote code execution?
The server must lack the PHP zip extension. Under that condition, a crafted uploaded archive can write files outside the intended upload directory, including executable PHP files.
What should be prioritized for remediation?
Update the plugin to version 2.0.21 or later. Until updating is possible, restrict access to the plugin's asset-management feature to trusted administrators and do not enable Editor access to it.