# Unlimited Elements for Elementor <= 2.0.26 - Authenticated (Contributor+) Sensitive Information Exposure via Post List Status Setting

- **ID:** WPSEC-2026-2501
- **Plugin:** Unlimited Elements for Elementor (`unlimited-elements-for-elementor`), https://wordpress.org/plugins/unlimited-elements-for-elementor/
- **Affected versions:** all versions before 2.0.28
- **Fixed in:** 2.0.28 (Update to 2.0.28 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/unlimited-elements-for-elementor
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2501/

## Description

The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure via the post list widgets' post status setting in all versions up to, and including, 2.0.26, due to the configured post statuses being passed straight to WP_Query without checking whether the current user may read posts in those statuses. This makes it possible for authenticated attackers with Contributor-level access and above, who can edit a post with Elementor, to configure a post list widget to show private, draft, pending or scheduled posts by other users and read their titles and content when the widget renders, for example in a post preview.

## References

- https://wpsec.com/vuln/WPSEC-2026-2501/
- https://plugins.svn.wordpress.org/unlimited-elements-for-elementor/tags/2.0.28/
- https://wordpress.org/plugins/unlimited-elements-for-elementor/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2501/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.