Unlimited Elements for Elementor, a WordPress plugin, contains a path traversal flaw in the Repeater JSON/CSV URL processing. The vulnerability allows an authenticated attacker with Author-level or higher access to craft a URL such as http://site.com/../../../../etc/passwd, causing the plugin to resolve the path to a sensitive local file and return its contents. The flaw is defined as CWE‑22 and enables the attacker to read arbitrary files, including WordPress configuration and credential files, thereby compromising confidentiality.

The issue impacts all installations of the Unlimited Elements for Elementor plugin for WordPress through version 2.0.6, regardless of the WordPress core version. Users running any 2.0.6 or earlier release are susceptible, especially if they have contributed or higher privileges and have debug output enabled in widget settings.

The CVSS score of 7.5 denotes moderate–high severity, while the EPSS score is currently unavailable, indicating insufficient data on current exploitation trends. Because exploitation requires a valid author‑level login and the ability to supply an arbitrary URL, the risk is significant in multi‑user sites or sites with loosely controlled plugin administration. The vulnerability is not listed in the CISA KEV catalog, but the path traversal weakness remains a classic, well‑known exploitation vector.