CVE-2023-6743: 
WordPress vulnerability analysis and mitigation

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin contains a Remote Code Execution vulnerability (CVE-2023-6743) affecting all versions up to and including 1.5.89. The vulnerability was discovered by Nex Team and publicly disclosed on May 28, 2024 (Wordfence Intel).

The vulnerability exists in the template import functionality of the plugin. It has been assigned a CVSS v3.1 base score of 8.8 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and high impact on confidentiality, integrity, and availability (NVD).

If exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to execute arbitrary code on the server, potentially leading to complete server compromise (Wordfence Intel).

The vulnerability requires an authenticated user with contributor-level privileges or higher to exploit. The attack can be executed remotely through the plugin's template import functionality (NVD).

Users are advised to update to version 1.5.91 or later which contains patches for this vulnerability (Wordfence Intel).