{"id":"CVE-2026-62023","kind":"vulnerability","aliases":["CVE-2026-62023"],"related":[],"title":"Unlimited Elements For Elementor: missing authorization lets users reach restricted functions","description":"Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.","summary":"Unlimited Elements For Elementor, a WordPress plugin that adds widgets and templates to Elementor, has an access control flaw in versions through 2.0.26. The sources say an attacker can exploit incorrectly configured access control to get actions they should not be allowed to perform.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","unlimited-elements-for-elementor","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the plugin `unlimited-elements-for-elementor` in the WordPress admin plugin list.\n- Confirm whether the installed version is `2.0.26` or earlier.","fix":null,"status":"open","published_at":"2026-10-30T19:18:31+00:00","first_seen_at":"2026-10-30T19:25:30+00:00","triaged_at":"2026-10-30T19:26:40+00:00","updated_at":"2026-10-30T19:26:40+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T19:26:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Unlimited Elements For Elementor: missing authorization lets users reach restricted functions","impact":"medium","summary":"Unlimited Elements For Elementor, a WordPress plugin that adds widgets and templates to Elementor, has an access control flaw in versions through 2.0.26. The sources say an attacker can exploit incorrectly configured access control to get actions they should not be allowed to perform.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elementor","unlimited-elements-for-elementor"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized actions on the WordPress site, scope unclear","analyst_note":"Check the vendor advisory or the NVD entry for the affected functions, required privilege, and the fixed version beyond 2.0.26.","how_to_check":"- Check the installed version of the plugin `unlimited-elements-for-elementor` in the WordPress admin plugin list.\n- Confirm whether the installed version is `2.0.26` or earlier.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Unlimited Elements For Elementor WordPress plugin at version 2.0.26 or earlier are in scope. The sources do not say which functions require an account or what an attacker can reach, so the exposure of any given site is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000692,"input_tokens":4170,"output_tokens":551,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-62023':14A,17A '2.0.26':48B,110C 'access':42B,58B,93C 'action':62B 'add':34B 'addon':82C,105C 'affect':98C 'allow':67B,89C 'attack':53B 'author':6A,71C 'configur':57B,92C 'control':43B,59B,94C 'cve':12A,15A 'element':2A,22B,27B,75C,77C,86C,100C 'elementor':4A,18B,24B,29B,39B,79C,88C,102C 'exploit':55B,90C 'flaw':44B 'free':80C,103C 'function':11A 'get':61B 'incorrect':56B,91C 'issu':97C 'let':7A 'levels.this':96C 'miss':5A,70C 'n/a':108C 'packag':19B 'perform':69B 'plugin':32B 'reach':9A 'restrict':10A 'say':51B 'secur':95C 'sourc':50B 'templat':37B,83C,106C 'unlimit':1A,21B,26B,74C,76C,85C,99C 'unlimited-elements-for-elementor':20B,84C 'user':8A 'version':46B 'vulner':72C 'widget':35B,81C,104C 'wordpress':25B,31B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Unlimited Elements For Elementor WordPress plugin at version 2.0.26 or earlier are in scope. The sources do not say which functions require an account or what an attacker can reach, so the exposure of any given site is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62023","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62023","severity":null,"published_at":"2026-10-30T19:18:31+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:30+00:00","fetched_at":"2026-10-30T19:25:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}