Executive Summary
A high-severity PHP Object Injection vulnerability (CVE-2026-85017, CVSS 7.5) has been disclosed in Unlimited Elements For Elementor, a widely used WordPress page-builder add-on. Versions before 2.0.20 fail to perform a capability check on an AJAX action that deserializes attacker-controlled stored data, allowing authenticated attackers with only subscriber-level access to inject arbitrary PHP objects.
Depending on other classes ("gadget chains") available in the site's codebase, PHP Object Injection of this kind can be escalated to remote code execution, arbitrary file deletion, or SQL injection.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-85017 |
| CVSS Score | 7.5 (High) |
| Type | Deserialization of Untrusted Data (CWE-502) |
| Attack Vector | Network — requires an authenticated, low-privileged account |
| Privileges Required | Subscriber (unpatched < 2.0.18) |
| Assigner | WPScan |
| Published | September 20, 2026 |
Root Cause
The plugin exposes an AJAX action used internally to process stored widget/template data. That handler does not verify the requesting user's capability before passing attacker-influenced, stored data into PHP's native deserialization function. Because the data is not treated as untrusted, a crafted serialized payload can instantiate arbitrary PHP objects available in the application's autoload path, triggering "magic methods" (__wakeup, __destruct, etc.) as a side effect of deserialization.
A partial fix shipped in versions 2.0.18–2.0.19 raised the required privilege to editor-level; the issue was fully resolved in 2.0.20, which removes the unauthenticated/low-privilege deserialization path entirely.
Affected Versions
| Plugin | Affected Versions | Fixed Version |
|---|---|---|
| Unlimited Elements For Elementor | < 2.0.20 (subscriber-exploitable < 2.0.18) | 2.0.20 |
Attack Vector
1. Attacker registers or holds a subscriber-level account on the target site
2. Attacker submits a crafted serialized PHP payload to the vulnerable AJAX action
3. Plugin deserializes the payload without a capability check
4. If a suitable gadget chain exists in loaded classes, magic methods execute
attacker-influenced logic (file writes, deletion, or code execution)Impact of Successful Exploitation
| Impact | Description |
|---|---|
| PHP Object Injection | Guaranteed outcome; escalation depends on available gadget chains |
| Potential RCE | If a suitable gadget chain exists in the plugin/theme stack |
| Data Manipulation | Arbitrary file writes or deletion via triggered magic methods |
| Low Barrier to Entry | Exploitable by any registered subscriber, not just admins |
Immediate Remediation
Step 1: Update to Version 2.0.20
wp plugin update unlimited-elements-for-elementor
wp plugin get unlimited-elements-for-elementor --field=versionStep 2: Restrict User Registration
If the site allows open subscriber-level registration, consider requiring manual approval until the plugin is patched:
wp option get users_can_register
wp option update users_can_register 0Step 3: Audit Existing Subscriber Accounts
wp user list --role=subscriber --fields=user_login,user_email,user_registeredLook for accounts registered in unusual batches or with disposable email domains — a common precursor to exploitation attempts.
If Immediate Patching Is Not Possible
- Disable public user registration
- Deploy a WAF rule to block serialized-PHP-looking payloads (
O:object markers) in AJAX requests - Monitor for unexpected file writes under the plugin's data directories