Unlimited Elements for Elementor <= 2.0.26 - Authenticated (Contributor+) Sensitive Information Exposure via Post List Status Setting
- ID
- WPSEC-2026-2501
- Plugin
- Unlimited Elements for Elementor (unlimited-elements-for-elementor)
- Affected
- all versions before 2.0.28
- Remediation
- Update to 2.0.28 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-04
- Attack surface
- Unlimited Elements for Elementor on WPSec AttackSurface
- Fix released
- Published
Description
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure via the post list widgets' post status setting in all versions up to, and including, 2.0.26, due to the configured post statuses being passed straight to WP_Query without checking whether the current user may read posts in those statuses. This makes it possible for authenticated attackers with Contributor-level access and above, who can edit a post with Elementor, to configure a post list widget to show private, draft, pending or scheduled posts by other users and read their titles and content when the widget renders, for example in a post preview.
References
- https://wpsec.com/vuln/WPSEC-2026-2501/
- https://plugins.svn.wordpress.org/unlimited-elements-for-elementor/tags/2.0.28/
- https://wordpress.org/plugins/unlimited-elements-for-elementor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS