Description

Contributor Arbitrary File Download in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.14 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-06T15:16:53.087Z",
  "pubdate": "2026-08-06T15:16:53.087Z",
  "executiveSummary": "An arbitrary file download vulnerability has been identified in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin, specifically affecting versions 2.0.14 and prior. This security flaw enables authenticated users with contributor-level privileges or higher to retrieve arbitrary files from the underlying server hosting the vulnerable WordPress installation. The primary risk implication of this vulnerability is the potential disclosure of sensitive system files, application source code, configuration files containing database credentials, or operational system files such as /etc/passwd. Exploitation requires authenticated access at the contributor privilege tier, which lowers the barrier for malicious actors who have obtained low-privileged author or contributor accounts on the target platform. Successful exploitation grants unauthorized read access to the server filesystem, potentially facilitating further attacks through the extraction of environmental secrets and internal infrastructure details.",
  "technicalDetails": "The vulnerability exists within the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress, impacting all versions up to and including 2.0.14. The root cause stems from insufficient input validation and a lack of proper access control checks on file retrieval functionality handled by the plugin. Specifically, parameters governing file paths are processed without adequate sanitization or boundary enforcement, allowing users to manipulate path traversal sequences or supply absolute file paths to access unauthorized resources on the host filesystem.\nThe attack flow begins when an authenticated attacker with contributor privileges crafts a malicious HTTP request targeting the vulnerable endpoint within the plugin. Because the underlying codebase fails to restrict file download operations to designated safe directories or adequately verify whether the requesting user possesses administrative privileges, the application processes the request and interacts with the filesystem using the privileges of the web server process.\nUpon receiving the request, the vulnerable component retrieves the specified file from the server's storage and streams its contents back to the client in the HTTP response. Attackers can leverage path traversal vectors (such as directory traversal sequences) or directly reference critical configuration files, such as wp-config.php, enabling the extraction of sensitive database credentials, salts, and API keys. The network exposure of this vulnerability is identical to the web application attack surface of the WordPress site, accessible over standard HTTP/HTTPS protocols where the application is hosted.\nPost-exploitation impact includes the aggregation of sensitive intelligence regarding the host system layout and application architecture. The retrieved information can subsequently be chained with other vulnerabilities to escalate privileges, execute remote code, or facilitate broader infrastructure compromise."
}