CVE Field Guide
About Us
CVE-2026-27041
PUBLISHED
WordPress Unlimited Elements for Elementor (Premium) plugin <= 2.0.6 - Arbitrary File Upload vulnerability
Assigner:
Patchstack
Reserved:
17.02.2026
Published:
17.06.2026
Updated:
17.06.2026
Contributor Arbitrary File Upload in Unlimited Elements for Elementor (Premium) <= 2.0.6 versions.
Metrics
CVSS 3.1
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score:
9.9
CVSS score
9.9
Attack Vector
Network
Scope
Changed
Attack Complexity
Low
Confidentiality Impact
High
Privileges Required
Low
Integrity Impact
High
User Interaction
None
Availability Impact
High
CVSS 3.1
Product Status
Vendor
Studio Keren Aga LTD.
Product
Unlimited Elements for Elementor (Premium)
Versions
Default:
unaffected
affected from n/a to 2.0.6 (incl.)
Credits
Phat RiO | Patchstack Bug Bounty Program
finder
References
https://patchstack.com/database/wordpress/plugin/unlimited-elements-for-elementor-premium/vulnerability/wordpress-unlimited-elements-for-elementor-premium-plugin-1-4-72-arbitrary-file-upload-vulnerability?_s_id=cve
Problem Types
CWE-434 Unrestricted Upload of File with Dangerous Type
CWE
Impacts
CAPEC-17 Using Malicious Files