CVE-2020-13126
An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125. An attacker with the Subscriber role can upl...
Affects 1 product across 1 vendor.
Application allows file uploads without validating type, enabling upload of executable code or web shells.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
A critical vulnerability in the Elementor Pro plugin for WordPress allows users with the Subscriber role to upload arbitrary executable files, leading to remote code execution.
BSID: BS-2020-GLOBAL-144837-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2020-13126?
What is the CVSS score for CVE-2020-13126?
Is CVE-2020-13126 actively exploited?
How do I remediate CVE-2020-13126?
What systems are affected by CVE-2020-13126?
| CVE ID | CVE-2020-13126 |
|---|---|
| BSID | BS-2020-GLOBAL-144837-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| Published | 2020-05-17 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 0% |
| Weakness (CWE) | |
| Source | NVD |
An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125. An attacker with the Subscriber role can upload arbitrary executable files to achieve remote code execution. NOTE: the free Elementor plugin is unaffected.
Source: NIST NVD / MITRE CVE Database
The vulnerability is exploited by an attacker with the Subscriber role uploading malicious files through the plugin's file upload functionality, which does not properly validate file types or contents.
Exploitation Likelihood: CRITICAL
| Vendor | Product | Affected Versions |
|---|---|---|
| Elementor | Elementor Page Builder | < 2.9.4 |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | f93369a4a9bbc9b50d2586bcbf845bc938cd3dd6bf49d29a277aa5991a7b57af010b33107d981edd5af405278486c4cd3148ad53398aa5b4992ff45a3b80be5d |
Critical Severity - Know Your Exposure
A CVSS 9.9 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →