EUVD lists PHP remote file inclusion flaw in Unlimited Elements For Elementor
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Unlimited Elements
- Product
- Unlimited Elements For Elementor
- First seen
Summary
The EUVD database entry EUVD-2026-114269, updated 2026-10-30, lists an Improper Control of Filename for Include/Require Statement (PHP Remote File Inclusion) vulnerability in Unlimited Elements For Elementor. It carries a CVSS v3.1 score of 6.5/10, and the item does not report confirmed exploitation.
If you use Unlimited Elements
Check whether Unlimited Elements For Elementor is installed on your WordPress sites
Update the plugin to a patched version as soon as the vendor releases one
Review the EUVD-2026-114269 entry for affected version ranges
Monitor web server logs for suspicious include or require parameters
Review the EUVD-2026-114277 entry for affected version ranges
What the sources say 2
· Mastodon: “Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Exploiting Incorrectl...” Source
· Mastodon: “Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets...” Source