Medium severity · published Oct 3, 2026
CVE-2026-85015
Unlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path Traversal
6.6
CVSS
0.4%
EPSS
No
On KEV
Description
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature (Administrators by default, or Editors when a non-default Unlimited Elements for Elementor WordPress plugin before 2.0.21 setting is enabled) to write arbitrary files, including executable PHP, outside the intended upload directory on servers where the PHP zip extension is unavailable, leading to Remote Code Execution.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UE
Unlimited Elements for Elementor ·
before 2.0.21 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-85015
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-85015
exploit
https://wpscan.com/vulnerability/aefcaecf-024d-4ec7-9b67-69d21addea7b/
More from Unlimited Elements for Elementor
8.8
CVE-2026-10081
Unlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews Widget
7.5
CVE-2026-85017
Unlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object Injection
6.8
CVE-2026-85568
Unlimited Elements For Elementor 1.5.139 - 2.0.20 - Unauthenticated SQLi via 'ucs' Parameter
6.8
CVE-2026-85016
Unlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library Parameter
6.3
CVE-2026-92923
Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscriber+ SQLi via get_addon_output_data