Description

The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. A partial fix in the 2.0.18 to 2.0.19 releases raised the privilege required to reach the vulnerable action to editor-level, and the issue was fully resolved in 2.0.20.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-20T07:16:50.303Z",
  "pubdate": "2026-09-20T07:16:50.303Z",
  "executiveSummary": "The Unlimited Elements For Elementor WordPress plugin contains a critical insecure deserialization vulnerability that allows authenticated attackers to inject arbitrary PHP objects.\nThe vulnerability stems from the absence of proper capability checks on an AJAX action, which processes attacker-controlled data without validation.\nInitially exploitable by subscribers, the vulnerability's privilege requirement was restricted to editor-level in versions 2.0.18 and 2.0.19, before being fully remediated in version 2.0.20.\nBy leveraging this flaw, an authenticated attacker can perform PHP object injection, which can lead to severe security outcomes, including remote code execution (RCE), arbitrary file deletion, or privilege escalation, depending on the available POP (Property-Oriented Programming) chains present in the application's environment.\nThe risk is significant for sites running versions prior to 2.0.20, as it permits unauthorized state manipulation and potential full system compromise by users with authenticated access.",
  "technicalDetails": "The root cause of this vulnerability is an insecure implementation of data handling within an AJAX action endpoint in the Unlimited Elements For Elementor plugin. The plugin fails to implement necessary server-side permission checks, allowing unauthorized users to trigger the processing of user-supplied serialized data.\nThe vulnerability manifests through the deserialization of untrusted input. When the plugin receives data via the vulnerable AJAX action, it utilizes PHP's unserialize() function on the payload without sanitization or origin verification. Because the application processes this data, it effectively allows an attacker to control the properties of objects being instantiated within the WordPress execution context.\nThe attack flow begins with an authenticated user (initially subscribers in versions prior to 2.0.18, and editors in 2.0.18-2.0.19) sending a crafted request to the AJAX endpoint. This request includes a serialized PHP object payload. Upon reaching the vulnerable function, the application triggers the deserialization process. If a POP chain—a sequence of magic methods like __wakeup, __destruct, or __toString present in existing plugins or themes—is available, the attacker can hijack the application's flow.\nBy manipulating the object properties during deserialization, an attacker can influence the state of the application after the object is destroyed or accessed. This can result in the execution of arbitrary code if the gadget chain allows for it, or sensitive file operations. Since the vulnerability processes these objects in the context of the web server, the post-exploitation impact is severe, potentially leading to a complete compromise of the WordPress installation.\nThe evolution of this vulnerability across versions indicates a failed attempt at remediation. Moving the privilege requirement from subscriber to editor (in 2.0.18-2.0.19) provided only partial defense, as the insecure deserialization logic remained present. It was not until version 2.0.20 that the underlying flaw was fundamentally addressed. Consequently, all environments utilizing versions before 2.0.20 are susceptible to the risks associated with deserialization attacks, necessitating an immediate update to the latest stable release to eliminate the vulnerability at its source."
}