# CVE-2026-85017: Unlimited Elements For Elementor PHP object injection in AJAX handler

Source: https://junglewise.ai/threats/cve-2026-85017-the-unlimited-elements-for-elementor-wordpress-plugin-before-2-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-20. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85017 · Severity: high · CVSS 7.5 · Published 2026-09-20

Unlimited Elements For Elementor is a WordPress plugin that extends the Elementor page builder with additional UI components. The plugin fails to validate user permissions on a specific AJAX action and deserializes untrusted data, allowing authenticated users with basic subscriber access to inject malicious PHP objects that could lead to arbitrary code execution on the website.

Technologies: [Unlimited Elements for Elementor](https://junglewise.ai/threats/technologies/unlimited-elements-for-elementor). Vendors: [Unlimited Elements](https://junglewise.ai/threats/vendors/unlimited-elements).

## Quick answers

**Is CVE-2026-85017 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85017 being exploited in the wild.

**How severe is CVE-2026-85017?** High severity, with a CVSS score of 7.5, published 20 September 2026.

**Which products and versions are affected?** Unlimited Elements for Elementor before 2.0.20.

**Is there a fix for CVE-2026-85017?** A patch was published on 2026-09-20: Fully resolved in 2.0.20; partial fix in 2.0.18–2.0.19 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85017 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-85017?** Check whether you run Unlimited Elements for Elementor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a PHP object injection (CWE-502) in an AJAX action handler that deserializes attacker-controlled data without proper capability checks. Authenticated attackers with subscriber-level privileges can craft malicious serialized PHP objects to achieve code execution. A partial fix in versions 2.0.18–2.0.19 elevated the required privilege to editor-level, and the issue was fully patched in version 2.0.20.

## Affected products

- Unlimited Elements Unlimited Elements For Elementor before 2.0.20

## Timeline

- 2026-09-18: disclosed
- 2026-09-20: patched: Fully resolved in 2.0.20; partial fix in 2.0.18–2.0.19

## References

- [https://wpscan.com/vulnerability/459a7479-ebd8-4e46-a709-cb86d0386f9b/](https://wpscan.com/vulnerability/459a7479-ebd8-4e46-a709-cb86d0386f9b/)

## Related threats

- [Unlimited Elements for Elementor stored cross-site scripting](https://junglewise.ai/threats/cve-2026-121579-improper-neutralization-of-input-during-web-page-generation)
- [Unlimited Elements for Elementor stored XSS in RSS feed widget](https://junglewise.ai/threats/cve-2026-116558-the-unlimited-elements-for-elementor-plugin-for-wordpress-is)
- [Unlimited Elements for Elementor reflected XSS](https://junglewise.ai/threats/cve-2026-62007-improper-neutralization-of-input-during-web-page-generation-cross)
- [Unlimited Elements for Elementor PHP local file inclusion](https://junglewise.ai/threats/cve-2026-62121-improper-control-of-filename-for-include-require-statement-in-php)
- [Unlimited Elements for Elementor missing authorization vulnerability](https://junglewise.ai/threats/cve-2026-62023-missing-authorization-vulnerability-in-unlimited-elements)