CVE-2026-28147

{
  "id": "CVE-2026-28147",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-03T08:17:20.377",
  "lastModified": "2026-10-23T22:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.15."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de ausencia de autorización en Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) permite la explotación de niveles de seguridad de control de acceso mal configurados.\n\nEste problema afecta a Unlimited Elements For Elementor (Free Widgets, Addons, Templates): desde n/a hasta 2.0.15."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Unlimited Elements",
          "product": "Unlimited Elements For Elementor (Free Widgets, Addons, Templates)",
          "defaultStatus": "unaffected",
          "collectionURL": "https://wordpress.org/plugins",
          "packageName": "unlimited-elements-for-elementor",
          "versions": [
            {
              "version": "n/a",
              "lessThanOrEqual": "2.0.15",
              "versionType": "custom",
              "status": "affected",
              "changes": [
                {
                  "at": "2.0.16",
                  "status": "unaffected"
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-03T14:02:07.889592Z",
          "id": "CVE-2026-28147",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://patchstack.com/database/wordpress/plugin/unlimited-elements-for-elementor/vulnerability/wordpress-unlimited-elements-for-elementor-free-widgets-addons-templates-plugin-2-0-15-broken-access-control-vulnerability?_s_id=cve",
      "source": "[email protected]"
    }
  ]
}