The vulnerability arises from unsafe reflection, where externally controlled input is used to select classes or code. An attacker can manipulate parameters sent to the Unlimited Elements For Elementor plugin, potentially causing the plugin to instantiate arbitrary classes and execute unintended code. This breach of access control may lead to execution of malicious code on the affected WordPress site, compromising confidentiality, integrity, and availability of the system.

Unlimited Elements: Unlimited Elements For Elementor (Free Widgets, Addons, Templates) is affected in all releases up to and including version 2.0.22. Any WordPress installation that has this plugin installed in those versions is vulnerable.

The CVSS score of 6.5 indicates moderate severity. Although the EPSS score is unavailable, the lack of a listed KEV entry suggests the vulnerability has not yet been widely exploited. The likely attack vector is remote, via crafted HTTP requests to the plugin’s endpoints directed at a WordPress site. An attacker needs network access to the site and the ability to supply malicious input; no local privilege escalation is required. If exploited, remote code execution is possible.