CVE-2020-13126: Elementor Page Builder

Critical severity, CVSS 9.9. EPSS: 8.6% chance of exploitation in the next 30 days.

An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125. An attacker with the Subscriber role can upload arbitrary executable files to achieve remote code execution. NOTE: the free Elementor plugin is unaffected.

Affected products

• Elementor Elementor Page Builder: before 2.9.4 (fixed in 2.9.4)

Published 2020-05-17. Last modified 2026-06-17.