Description
Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Object Injection.

This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.19.
Published: 2026-10-07
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

WordPress Unlimited Elements For Elementor plugin has a deserialization flaw that allows attacker to inject crafted objects via unserialized user input. This PHP Object Injection can lead to arbitrary code execution on the web server, compromising site confidentiality, integrity, and availability. The weakness is identified as CWE-502.

Affected Systems

The vulnerability affects the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress, versions up to and including 2.0.19. No specific WordPress core or other product versions are mentioned.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, with the EPSS score unavailable so the likelihood is uncertain. Because it is a WordPress plugin vulnerability, it is inferred that the attack can be carried out remotely via crafted HTTP requests that trigger unserialization. The vulnerability is not listed in the CISA KEV catalog. Administrators should treat this as a high‑risk flaw that can be exploited by remotely authenticated or unauthenticated attackers who can manipulate plugin data.

Generated by OpenCVE AI on October 7, 2026 at 18:33 UTC.

Remediation

Vendor Solution

Update the WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin to the latest available version (at least 2.0.20).

OpenCVE Recommended Actions

  • Update the Unlimited Elements For Elementor plugin to version 2.0.20 or later.
  • If upgrading is not immediately possible, deactivate the plugin to eliminate the exploitation path.
  • Monitor WordPress logs for suspicious activity related to unserialized input and restrict access to affected endpoints as a temporary precaution.

Generated by OpenCVE AI on October 7, 2026 at 18:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Unlimited-elements
Unlimited-elements unlimited Elements For Elementor (free Widgets, Addons, Templates)
Wordpress-extensions
Wordpress-extensions unlimited Elements For Elementor
Vendors & Products Unlimited-elements
Unlimited-elements unlimited Elements For Elementor (free Widgets, Addons, Templates)
Wordpress-extensions
Wordpress-extensions unlimited Elements For Elementor

Wed, 07 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Object Injection. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.19.
Title WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - PHP Object Injection vulnerability
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Unlimited-elements Unlimited Elements For Elementor (free Widgets, Addons, Templates)
Wordpress-extensions Unlimited Elements For Elementor
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-07T17:32:12.169Z

Reserved: 2026-09-22T09:08:40.703Z

Link: CVE-2026-95534

cve-icon Vulnrichment

Updated: 2026-10-07T17:32:07.174Z

cve-icon NVD

Status : Deferred

Published: 2026-10-07T17:17:03.783

Modified: 2026-10-08T17:24:31.040

Link: CVE-2026-95534

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T08:14:43Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data