CVE-2024-2662 Command injection in Unlimited Elements For Elementor

High 7.2 Published 10 May 2024 Updated 8 Apr 2026

Authenticated administrators can execute arbitrary commands on the server via insufficient filtering of template attributes in the Unlimited Elements plugin.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-2662?

CVE-2024-2662 is a high-severity command injection vulnerability in unitecms Unlimited Elements For Elementor, published on 10 May 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to command injection in all versions up to, and including, 1.5.102. This is due to insufficient filtering of template attributes during the creation of HTML for custom widgets This makes it possible for authenticated attackers, with administrator-level access and above, to execute arbitrary commands on the server.

Weakness: CWE-78

Which versions are affected by CVE-2024-2662?

It affects 1 product.

Products include Unlimited-Elements Unlimited Elements for Elementor.

How do I fix CVE-2024-2662?

No fix has been published for CVE-2024-2662 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2024-2662 being exploited?

There is no known exploitation of CVE-2024-2662 in the wild and no public exploit code.

Sources

Also known as GHSA-p557-3fgh-xgcq.