CVE-2026-27041: WordPress Unlimited Elements for Elementor (Premium) plugin <= 2.0.6 - Arbitrary File Upload vulnerability

Synopsis

An arbitrary file upload vulnerability affects the Unlimited Elements for Elementor (Premium) WordPress plugin at version 2.0.6 and earlier. The flaw is reachable over the network and requires only a low-privilege contributor account, meaning any registered contributor on an affected WordPress site can exploit it without any additional interaction from other users. Successful exploitation gives an attacker full control over confidentiality, integrity, and availability of the host, including the ability to upload and execute malicious files for remote code execution. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as the upstream vendor ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress site via HTTP/HTTPS to deliver a malicious file upload request.

• AuthenticationRequired

  A low-privilege contributor account on the WordPress site is sufficient; no administrative or elevated privileges are needed beyond that basic authenticated role.

• Victim interactionNot required

  No action from another user or administrator is needed; the attacker operates entirely on their own once they have contributor-level credentials.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and straightforward with no race conditions, special memory layouts, or other unpredictable environmental factors required.

Blast Radius

• An attacker uploads an arbitrary file (such as a PHP webshell) and executes it on the server, gaining remote code execution on the underlying host.
• Full read access to all data on the WordPress installation is gained, including database credentials, user records, and any stored secrets.
• An attacker can modify or delete persisted files, database rows, and site content, resulting in complete integrity loss across the application.
• The attacker can crash or destabilize the service, causing a full denial of availability for the site and any co-hosted applications.