Exploitation Research Plan: CVE-2026-4659 (Unlimited Elements For Elementor)

1. Vulnerability Summary

The Unlimited Elements For Elementor plugin (<= 2.0.6) contains an authenticated arbitrary file read vulnerability. The flaw exists in how the plugin converts a provided "Repeater JSON/CSV URL" into a local file path. Specifically, the URLtoRelative() function removes the site's base URL via simple string replacement without sanitizing for path traversal (../) sequences. When this processed string is passed to urlToPath(), it is concatenated with the site's base path and resolved. An attacker can provide a URL pointing to the local site followed by traversal sequences (e.g., https://example.com/../../../../etc/passwd) to read any file on the server that the PHP process has permission to access.

2. Attack Vector Analysis

• Endpoint: Elementor Editor / Post Save (via _elementor_data post meta) or the widget rendering engine.
• Vulnerable Parameters: Any widget field that utilizes the "Repeater" with "Remote JSON/CSV" functionality. Specifically, the parameter used to store the remote URL.
• Authentication: Contributor-level access or higher is required to edit posts/pages and use Elementor widgets.
• Preconditions:
  1. The plugin "Unlimited Elements" must be active.
  2. The attacker must use or create a widget that utilizes a "Repeater" field with "Remote Data" enabled.
  3. The widget's debug mode or data display must be configured to output the fetched content (or the content must be rendered in the widget).

3. Code Flow

1. Entry Point: A widget is rendered on the frontend or inside the Elementor editor.
2. Data Fetching: The widget checks if "Remote JSON/CSV" is enabled.
3. Path Resolution:
   • The user-provided URL (e.g., get_option('siteurl') . '/../../../../etc/passwd') is passed to URLtoRelative().
   • URLtoRelative() (inferred file: provider/core/framework/helpers/unite_functions.class.php) performs: str_replace(get_option('siteurl'), '', $url).
   • Result: /../../../../etc/passwd.
   • urlToPath() takes this result and prepends ABSPATH.
   • cleanPath() normalizes slashes but does not remove ../.
4. File Sink: The resolved path is passed to a file-reading function like file_get_contents() to retrieve the "JSON/CSV" data.
5. Output: If the "Debug" option is enabled in the widget settings, or if the file content is mapped to a visible field in the repeater, the contents of the file are echoed to the page.

4. Nonce Acquisition Strategy

Accessing the Elementor editor as a Contributor requires standard WordPress authentication. Saving and rendering Elementor widgets requires the elementor_ajax nonce or the post-specific nonce.

Strategy:

1. Log in as a Contributor.
2. Create a temporary post: wp post create --post_type=post --post_status=publish --post_title="Exploit Page".
3. Navigate to the Elementor editor for that post: browser_navigate("/wp-admin/post.php?post=ID&action=elementor").
4. Extract the Elementor configuration nonces using browser_eval:
   • browser_eval("window.elementorConfig.nonces.save_builder")
5. Unlimited Elements also localizes data. Check for:
   • browser_eval("window.unite_admin_options?.nonce") (inferred localization key).

5. Exploitation Strategy

The goal is to update a post's Elementor data to include a widget that attempts to read /etc/passwd.

1. Preparation: Identify a widget slug from Unlimited Elements that supports repeaters (e.g., uc_simple_list or uc_remote_json_tester).
2. Identify Meta Structure: Elementor stores data in the _elementor_data post meta as a JSON string.
3. Construct Payload:
   • Create a JSON structure for an Elementor page containing one Unlimited Elements widget.
   • In the widget settings, set the remote URL parameter to: [SITE_URL]/../../../../../../../../etc/passwd.
   • Set the "use_remote_data" flag to true.
   • Set the "debug_mode" or "show_errors" flag to true (if available).
4. Update Post Meta: Use the http_request tool to send a POST request to admin-ajax.php with the elementor_ajax action to save the builder data.
   • Action: elementor_ajax
   • Actions Payload: {"save_builder":{"action":"save_builder","data":{"status":"publish","elements":[...MALICIOUS_JSON...]}}}
5. Trigger Read: Navigate to the published post's URL. The rendering engine will execute the file read.
6. Extract Data: Scrape the response body for the contents of /etc/passwd.

6. Test Data Setup

1. User: Create a Contributor user.
   • wp user create attacker attacker@example.com --role=contributor --user_pass=password
2. Plugin Config: Ensure "Unlimited Elements" is active.
3. Post: Create a post to be edited.
   • wp post create --post_type=post --post_status=publish --post_author=[USER_ID] --post_title="Traversal Test"
4. Site URL: Determine the site URL for the payload prefix.
   • wp option get siteurl

7. Expected Results

• The http_request to admin-ajax.php returns {"success":true}.
• When navigating to the post frontend, the HTML contains the string root:x:0:0:root:/root:/bin/bash or the contents of wp-config.php.

8. Verification Steps

1. Meta Verification: Check if the malicious URL was successfully saved.
   • wp post meta get [POST_ID] _elementor_data
2. Log Check: Check the WordPress debug log if the output isn't visible on the frontend.
   • tail -f wp-content/debug.log
3. File Content Verification: Compare the exposed content with the actual file on the system (if in a controlled environment).

9. Alternative Approaches

• Direct Meta Update: If the elementor_ajax request is too complex, use wp post meta update [ID] _elementor_data '[JSON]' via the shell to set up the state, then use the browser to simply view the result.
• Different File: If /etc/passwd is restricted, attempt to read wp-config.php by calculating the depth from the wp-content/plugins/unlimited-elements-for-elementor/ directory.
  • Payload: [SITE_URL]/../../wp-config.php
• Shortcode Vector: Some Unlimited Elements widgets can be triggered via shortcode. Attempt to inject the traversal via a shortcode attribute if the widget supports it: [uc_widget_name remote_url="..."].