Arbitrary File Read Vulnerability in Unlimited Elements for Elementor Plugin by WordPress

CVE-2026-4659

What is CVE-2026-4659?

The Unlimited Elements for Elementor plugin has a vulnerability that allows authenticated users with Author-level access or higher to read arbitrary files on the server. This security issue arises from inadequate sanitization in the path traversal functions, particularly in URLtoRelative() and urlToPath(). The functions fail to sufficiently clean up input, making it possible for attackers to exploit this flaw using specially crafted URLs. By executing requests with malicious parameters, attackers can gain access to sensitive files, such as the wp-config file, leading to serious implications for data integrity and site security.

References