WordPress Plugin Vulnerabilities

Unlimited Elements for Elementor < 2.0.23 - Missing Authorization

Description

The Unlimited Elements for Elementor plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0.22. This is due to a missing capability check on a function. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
unlimited-elements-for-elementor
Fixed in 2.0.23

References

CVE
CVE-2026-105064
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/85283c15-3632-4b73-9f75-17a828fb3114

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Ayukiab
Verified
No
WPVDB ID
cfbc72ca-44c7-4a66-b78f-070774db1454

Timeline

Publicly Published
2026-10-05 (about 12 days ago)
Added
2026-10-09 (about 7 days ago)
Last Updated
2026-10-09 (about 7 days ago)

Other

Published
Title
Published
2024-03-29
Title
SP Project & Document Manager <= 4.70 - Missing Authorization Stored Cross-Site Scripting
Published
2026-05-02
Title
Event Tickets and Registration < 5.27.6.1 - Missing Authorization
Published
2026-06-05
Title
LearnPress < 4.3.7 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters
Published
2025-12-08
Title
WP-CRM System < 3.4.7 - Missing Authorization
Published
2024-04-16
Title
WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) < 3.1.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion