Unlimited Elements For Elementor Plugin Vulnerable to PHP Object Injection

Executive Summary

A high-severity PHP Object Injection vulnerability (CVE-2026-85017, CVSS 7.5) has been disclosed in Unlimited Elements For Elementor, a widely used WordPress page-builder add-on. Versions before 2.0.20 fail to perform a capability check on an AJAX action that deserializes attacker-controlled stored data, allowing authenticated attackers with only subscriber-level access to inject arbitrary PHP objects.

Depending on other classes ("gadget chains") available in the site's codebase, PHP Object Injection of this kind can be escalated to remote code execution, arbitrary file deletion, or SQL injection.

Vulnerability Overview

Root Cause

The plugin exposes an AJAX action used internally to process stored widget/template data. That handler does not verify the requesting user's capability before passing attacker-influenced, stored data into PHP's native deserialization function. Because the data is not treated as untrusted, a crafted serialized payload can instantiate arbitrary PHP objects available in the application's autoload path, triggering "magic methods" (__wakeup, __destruct, etc.) as a side effect of deserialization.

A partial fix shipped in versions 2.0.18–2.0.19 raised the required privilege to editor-level; the issue was fully resolved in 2.0.20, which removes the unauthenticated/low-privilege deserialization path entirely.

Affected Versions

Attack Vector

1. Attacker registers or holds a subscriber-level account on the target site
2. Attacker submits a crafted serialized PHP payload to the vulnerable AJAX action
3. Plugin deserializes the payload without a capability check
4. If a suitable gadget chain exists in loaded classes, magic methods execute
   attacker-influenced logic (file writes, deletion, or code execution)

Impact of Successful Exploitation

Immediate Remediation

Step 1: Update to Version 2.0.20

wp plugin update unlimited-elements-for-elementor
wp plugin get unlimited-elements-for-elementor --field=version

Step 2: Restrict User Registration

If the site allows open subscriber-level registration, consider requiring manual approval until the plugin is patched:

wp option get users_can_register
wp option update users_can_register 0

Step 3: Audit Existing Subscriber Accounts

wp user list --role=subscriber --fields=user_login,user_email,user_registered

Look for accounts registered in unusual batches or with disposable email domains — a common precursor to exploitation attempts.

If Immediate Patching Is Not Possible

1. Disable public user registration
2. Deploy a WAF rule to block serialized-PHP-looking payloads (O: object markers) in AJAX requests
3. Monitor for unexpected file writes under the plugin's data directories

References

• OffSeq Threat Radar — CVE-2026-85017
• NVD — CVE-2026-85017

Related Reading

• CVE-2026-3589: WooCommerce CSRF Flaw Allows Unauthenticated
• WordPress Plugin Vulnerability (CVSS 10.0) Under Active