CVE-2020-7055

The Elementor Website Builder plugin contained an authorization bypass in its Import Templates feature that allowed users with subscriber-level access and higher to upload arbitrary files, potentially leading to remote code execution. The vulnerability existed in versions prior to 2.7.5 due to insufficient permission checks on the file upload functionality. Attackers could exploit this flaw to execute malicious code on affected WordPress installations.

Based on public CVE data (MITRE/NVD).