The Unlimited Elements for Elementor plugin, before version 2.0.21, fails to verify that the user requesting widget output has permission to do so. An attacker with a WordPress role as low as subscriber can invoke the widget output function and cause any WordPress shortcode embedded in the widget to be executed. Executing arbitrary shortcodes can lead to remote code execution, allowing the attacker to run malicious code, modify site content, or exfiltrate data.

This flaw affects the Unlimited Elements for Elementor WordPress plugin in all releases prior to 2.0.21. Users on version 2.0.18 and earlier are vulnerable, while subscribers are still at risk only up to that point; from 2.0.18 onward, the issue requires at least a Contributor role to exploit. The vulnerability exists across WordPress sites that have the plugin installed and remain on outdated revisions.

The CVSS score of 5.4 indicates moderate severity. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires authenticated access with a role as low as subscriber (or higher for newer versions). Because the attack vector is limited to authorized users within the site, the likelihood of widespread exploitation is lower than for publicly exposed bugs, yet any user profile with the necessary role can trigger malicious shortcode execution if an attacker can create or compromise such an account. The overall risk is considered moderate, with the potential for serious impact if the site employs sensitive or critical shortcodes.