CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Code Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 1.5.66.
Explanation of Vulnerability in Simple Terms
Unlimited Elements For Elementor allows authenticated administrators to upload files without proper validation. An attacker with admin privileges can upload malicious files, including PHP code, to execute arbitrary commands on the site. The vulnerability affects all versions up to 1.5.66. Site owners should update immediately to a patched version.
What an attacker can do
Upload and execute malicious files on the site, including PHP code to run arbitrary commands.
Potential impact on your site
A compromised admin account can lead to full site takeover, data theft, or malware installation.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
