CVE-2026-28146 MEDIUM

CVE-2026-28146: WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability

Vendor Unlimited Elements
Product Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Weakness CWE-22 · Path traversal
Published August 6, 2026
Last update August 6, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Contributor Arbitrary File Download in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.14 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Unlimited Elements For Elementor contains a path traversal vulnerability that allows authenticated users to read files outside the intended directory. An attacker with low-level site access can enumerate and access sensitive files on the server by manipulating file paths. This affects versions up to 2.0.14. Update to a version newer than 2.0.14 to resolve the issue.

What an attacker can do

03Attacker Capabilities

Read arbitrary files on the server outside the plugin's intended directory.

Potential impact on your site

04Site Impact

Any user with contributor or subscriber access can read sensitive files like configuration files or database backups.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege authenticated account on the site.

Key dates

06Disclosure timeline

August 6, 2026 CVE published
August 6, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-9145 Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Copy/Upload via Elementor Pro Form Upload Field 'raw_value' CVE-2026-9725 Printcart Web to Print Product Designer for WooCommerce <= 2.5.2 - Unauthenticated Arbitrary File Deletion CVE-2026-13339 CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter CVE-2026-57331 WordPress Paid Videochat Turnkey Site plugin <= 7.4.8 - Arbitrary File Deletion vulnerability CVE-2026-13347 Hide My WP Lite <= 1.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'he_wrapper_js' Parameter