CVE-2026-92924: Unlimited Elements For Elementor < 2.0.21 - Subscriber+ Arbitrary Shortcode Execution via get_addon_output_data
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Unlimited Elements for Elementorto a version that resolves this vulnerability.Fixed in 2.0.21
Event History
Frequently Asked Questions
Which user roles can exploit this issue in affected versions?
In versions before 2.0.18, a Subscriber-level account can exploit it. In versions 2.0.18 through 2.0.20, exploitation requires a Contributor role or higher.
Is an unauthenticated attacker able to exploit this vulnerability?
No. The vulnerability requires an authenticated WordPress account with the applicable minimum role for the installed plugin version.
What is the practical impact of successful exploitation?
An attacker can cause arbitrary WordPress shortcodes to execute on the site. The reported impact is limited confidentiality and integrity impact, with no availability impact indicated.