CVE-2026-4659

OVERVIEW CVE-2026-4659 is a path traversal vulnerability affecting the Unlimited Elements for Elementor plugin for WordPress in versions up to 2.0.6. The flaw exists in the Repeater JSON/CSV URL parameter functionality, where insufficient input sanitization in the URLtoRelative() and urlToPath() functions allows attackers to bypass path restrictions. By crafting malicious URLs containing directory traversal sequences (../), an attacker can read arbitrary files from the affected WordPress server. SEVERITY This vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network-based attack vector requiring no user interaction and no privileges. The attack complexity is low, meaning exploitation is straightforward. The vulnerability results in complete compromise of confidentiality, as attackers can access sensitive files including wp-config.php and other protected system files. Notably, the CVSS score indicates no integrity or availability impact, as this is strictly an information disclosure issue. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, as reflected by the absence of this vulnerability from CISA's Known Exploited Vulnerabilities (KEV) catalog and its inactive status on the Hot List. The EPSS score of 0.00039 indicates very low probability of exploitation, falling well below the average threat percentile. While exploit code development would be relatively straightforward given the nature of the vulnerability, there are no reports of widespread public exploitation or proof-of-concept availability at this time.