{
 "id": "WPSEC-2026-2501",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2501/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2501/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2501/index.md",
 "title": "Unlimited Elements for Elementor <= 2.0.26 - Authenticated (Contributor+) Sensitive Information Exposure via Post List Status Setting",
 "description": "The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure via the post list widgets' post status setting in all versions up to, and including, 2.0.26, due to the configured post statuses being passed straight to WP_Query without checking whether the current user may read posts in those statuses. This makes it possible for authenticated attackers with Contributor-level access and above, who can edit a post with Elementor, to configure a post list widget to show private, draft, pending or scheduled posts by other users and read their titles and content when the widget renders, for example in a post preview.",
 "plugin": {
  "slug": "unlimited-elements-for-elementor",
  "name": "Unlimited Elements for Elementor",
  "full_name": "Unlimited Elements for Elementor",
  "wordpress_org": "https://wordpress.org/plugins/unlimited-elements-for-elementor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/unlimited-elements-for-elementor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/unlimited-elements-for-elementor"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.0.28",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.0.28"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.0.28",
 "remediation": "Update to 2.0.28 or later.",
 "fix_released": "2026-11-03T15:12:39+00:00",
 "published": "2026-11-04T15:47:10+00:00",
 "updated": "2026-11-04T14:28:12.492948+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2501/",
  "https://plugins.svn.wordpress.org/unlimited-elements-for-elementor/tags/2.0.28/",
  "https://wordpress.org/plugins/unlimited-elements-for-elementor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/unlimited-elements-for-elementor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-04"
 }
}