Unlimited Elements For Elementor < 2.0.21 - Authenticated (Contributor+) Information Exposure via Elementor Template and Layout Rendering
- ID
- WPSEC-2026-0029
- Plugin
- Unlimited Elements for Elementor (unlimited-elements-for-elementor)
- Affected
- all versions before 2.0.21
- Remediation
- Update to 2.0.21 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Unlimited Elements For Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.0.20 because Elementor content was loaded by post ID without checking that the current user may read that post: the putElementorTemplate widget function rendered any template ID set in widget settings, and the front-end AJAX filter and search requests loaded the Elementor data of any 'layoutid'. This makes it possible for authenticated attackers, with contributor-level access and above, to view the content of private, draft and password-protected posts and templates. Unauthenticated attackers can also render widgets from such posts through the front-end AJAX requests if they know the widget's element ID.
References
- https://wpsec.com/vuln/WPSEC-2026-0029/
- https://plugins.svn.wordpress.org/unlimited-elements-for-elementor/tags/2.0.21/
- https://wordpress.org/plugins/unlimited-elements-for-elementor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS