Live › vulnerability › CVE-2026-62121
Unlimited Elements For Elementor, a WordPress plugin, has a PHP file inclusion flaw that lets a request load a local file into PHP. The sources do not say what an attacker can read or run from there.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running the Unlimited Elements For Elementor WordPress plugin at version 2.0.26 or earlier are in the affected range. The sources do not say which plugin features or request paths trigger the flaw, or whether a logged-in user is needed. Sites without this plugin can skip it.
No product ranges from the sources yet.
wp-content/plugins/unlimited-elements-for-elementor/2.0.26Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.
This page as .md · .json · in your agent: get_signal("CVE-2026-62121")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.