{"id":"CVE-2026-62121","kind":"vulnerability","aliases":["CVE-2026-62121"],"related":[],"title":"Unlimited Elements For Elementor: local file inclusion through version 2.0.26","description":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.","summary":"Unlimited Elements For Elementor, a WordPress plugin, has a PHP file inclusion flaw that lets a request load a local file into PHP. The sources do not say what an attacker can read or run from there.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","unlimited-elements-for-elementor","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin plugin list, or in `wp-content/plugins/unlimited-elements-for-elementor/`\n- Compare the version against the affected range: through `2.0.26`","fix":"- Unlimited Elements For Elementor: unknown; the sources give no fixed version","status":"open","published_at":"2026-10-30T19:18:32+00:00","first_seen_at":"2026-10-30T19:25:30+00:00","triaged_at":"2026-10-30T19:26:14+00:00","updated_at":"2026-10-30T19:26:14+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T19:26:14Z","model":"claude-haiku-5-5","output":{"fix":"- Unlimited Elements For Elementor: unknown; the sources give no fixed version","reach":"unknown","title":"Unlimited Elements For Elementor: local file inclusion through version 2.0.26","impact":"medium","summary":"Unlimited Elements For Elementor, a WordPress plugin, has a PHP file inclusion flaw that lets a request load a local file into PHP. The sources do not say what an attacker can read or run from there.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","unlimited-elements-for-elementor","elementor"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; sources say local file inclusion, not what gets read or run","analyst_note":"Confirm the fixed version and whether the flaw is reachable without authentication, starting from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-62121.","how_to_check":"- Check the installed plugin version in the WordPress admin plugin list, or in `wp-content/plugins/unlimited-elements-for-elementor/`\n- Compare the version against the affected range: through `2.0.26`","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Unlimited Elements For Elementor WordPress plugin at version 2.0.26 or earlier are in the affected range. The sources do not say which plugin features or request paths trigger the flaw, or whether a logged-in user is needed. Sites without this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000716,"input_tokens":4183,"output_tokens":596,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-62121':13A,16A '2.0.26':10A,109C 'addon':84C,104C 'affect':97C 'allow':91C 'attack':55B 'control':61C 'cve':11A,14A 'element':2A,21B,26B,77C,79C,88C,99C 'elementor':4A,17B,23B,28B,81C,90C,101C 'file':6A,35B,45B,72C,94C 'filenam':63C 'flaw':37B 'free':82C,102C 'improp':60C 'include/require':65C 'inclus':7A,36B,73C 'inclusion.this':95C 'issu':96C 'let':39B 'load':42B 'local':5A,44B,93C 'n/a':107C 'packag':18B 'php':34B,47B,68C,70C,92C 'plugin':31B 'program':69C 'read':57B 'remot':71C 'request':41B 'run':59B 'say':52B 'sourc':49B 'statement':66C 'templat':85C,105C 'unlimit':1A,20B,25B,76C,78C,87C,98C 'unlimited-elements-for-elementor':19B,86C 'version':9A 'vulner':74C 'widget':83C,103C 'wordpress':24B,30B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Unlimited Elements For Elementor WordPress plugin at version 2.0.26 or earlier are in the affected range. The sources do not say which plugin features or request paths trigger the flaw, or whether a logged-in user is needed. Sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62121","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62121","severity":null,"published_at":"2026-10-30T19:18:32+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:30+00:00","fetched_at":"2026-10-30T19:25:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}