CVE-2026-85017: Unlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object Injection
The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. A partial fix in the 2.0.18 to 2.0.19 releases raised the privilege required to reach the vulnerable action to editor-level, and the issue was fully resolved in 2.0.20.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Unlimited Elements For Elementor WordPress pluginto a version that resolves this vulnerability.Fixed in 2.0.20
Event History
Frequently Asked Questions
Which versions and user roles are affected?
Versions before 2.0.18 allow authenticated users with subscriber-level access to reach the vulnerable AJAX action. Versions 2.0.18 through 2.0.19 restrict access to editor-level users but remain affected; 2.0.20 fully resolves the issue.
What does an attacker need to exploit this issue?
The attacker needs an authenticated WordPress account with the required role for the installed plugin version. They must be able to invoke the affected AJAX action and supply attacker-controlled stored data that is deserialized.
What can be done if upgrading immediately is not possible?
Reduce or eliminate untrusted user access at the applicable role level. For versions before 2.0.18, review subscriber accounts; for 2.0.18 and 2.0.19, review editor accounts, since those roles can reach the vulnerable action.