This CVE affects Unlimited Elements For Elementor, a popular widget library for Elementor. The vulnerability is an AJAX endpoint handling template import or preview functionality that checks only whether a user is logged in (is_logged_in) rather than verifying they have administrative capabilities (current_user_can('manage_options')). This allows any logged-in user — including contributors, who can create content but not publish it — to trigger file operations that should be restricted to administrators.
The CVSS score suggests medium severity, but treat this as critical. A contributor with the ability to read arbitrary files can access wp-config.php, which contains database credentials. Those credentials can then be used to access the plugin's update mechanism (normally admin-only), giving the contributor full site takeover in two hops. This is not a theoretical cascade — it is the documented exploitation path for this exact privilege escalation pattern in WordPress.
Action items: First, confirm whether you are running version 2.0.14 or any version that introduced template import or preview features — the vulnerability likely entered when file operation capabilities were added to an existing AJAX handler without re-auditing authorization. Second, if you cannot patch immediately, consider temporarily disabling the plugin or restricting AJAX access at the web server level until an update is available. Third, after patching, audit the plugin's other AJAX endpoints — where you find one missing capability check in a file operation handler, others often exist.
The broader pattern matters here. This is not an isolated coding mistake but part of a documented lineage of WordPress plugin CVEs where AJAX handlers for file operations check authentication without capability authorization. The development context of WordPress AJAX — which executes in a severed capability-checking context — makes this class of failure easy to overlook. The fix is typically a single current_user_can('manage_options') call, but that one-call remediation does not propagate to the dozens of other plugins with similar exposed endpoints. Assume this pattern exists elsewhere in your WordPress environment and prioritize auditing any plugin that handles file operations over AJAX.