The Unlimited Elements for Elementor plugin for WordPress contains a path traversal vulnerability that allows authenticated attackers with Author-level access to read sensitive local files, including wp-config.

This vulnerability is a path traversal flaw (CWE-22) occurring in the URLtoRelative() and urlToPath() functions. Authenticated attackers with Author-level access or higher can exploit insufficient sanitization of traversal sequences to access restricted system files.

The ability to read arbitrary files, specifically configuration files like wp-config, exposes sensitive database credentials, API keys, and administrative information. This unauthorized access severely compromises the confidentiality of the WordPress installation and provides a pathway for further escalation or full system takeover. The CVSS score of 7.5 reflects the high impact on data confidentiality.

Immediate Action: As no specific patch version is currently identified, administrators should immediately disable or uninstall the Unlimited Elements for Elementor plugin until a secure update is released by the vendor.

Proactive Monitoring: Monitor server access logs for suspicious requests containing traversal patterns such as "../" directed at the plugin's repeater functionality.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing directory traversal sequences directed at WordPress plugin parameters.

Public Exploit Available: No (exploit_available: unknown)

Given the potential for complete exposure of sensitive site configurations, this vulnerability presents a significant risk to WordPress environments. Organizations should prioritize the removal or deactivation of the affected plugin until a vendor-supplied security patch is confirmed and applied.