CVEvulnerability
CVE-2023-6743
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2024-05-29
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-1336, CWE-94
Description
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.89 via the template import functionality. This makes it possible for authenticated attackers, with contributor access and above, to execute code on the server.
Affected configurations
• unlimited-elements unlimited elements for elementor (<= 1.5.89)
Related
References
- https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_output.class.php#L1765 Product
- https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/core/plugins/unlimited_elements/elementor/elementor_widget.class.php#L3948 Product
- https://plugins.trac.wordpress.org/changeset/3010986/unlimited-elements-for-elementor#file6 Patch
- https://plugins.trac.wordpress.org/changeset/3015166/unlimited-elements-for-elementor Patch
- https://www.wordfence.com/threat-intel/vulnerabilities/id/25f71a19-85b1-4bc9-b193-d9de2eba81ee?source=cve Third Party Advisory
- https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_output.class.php#L1765 Product
- https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/core/plugins/unlimited_elements/elementor/elementor_widget.class.php#L3948 Product
- https://plugins.trac.wordpress.org/changeset/3010986/unlimited-elements-for-elementor#file6 Patch
- https://plugins.trac.wordpress.org/changeset/3015166/unlimited-elements-for-elementor Patch
- https://www.wordfence.com/threat-intel/vulnerabilities/id/25f71a19-85b1-4bc9-b193-d9de2eba81ee?source=cve Third Party Advisory