Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.66 - Authenticated (Contributor+) Arbitrary File Upload

CVE-2023-3295

Summary

The Unlimited Elements for Elementor plugin for WordPress, specifically in versions up to 1.5.66, has a vulnerability that permits arbitrary file uploads. This flaw arises from inadequate validation of file types within the file manager functionality. Authenticated attackers with contributor-level permissions or higher can exploit this vulnerability to upload malicious files to the server, potentially leading to remote code execution. Though an initial patch was implemented in version 1.5.66, it was only fully resolved in version 1.5.67. Additionally, CVE-2023-31231 is noted as a duplicate of this vulnerability.

References