Executive brief
Unlimited Elements for Elementor is a popular WordPress plugin used to add custom widgets and features to websites. A security flaw in this plugin allows users with basic contributor-level access to bypass security measures and run unauthorized database commands. This could lead to the theft of sensitive information, such as user credentials or site configuration data, potentially compromising the entire website.
Technical details
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to SQL Injection due to improper input handling in the 'get_cat_addons' AJAX action. The 'normalizeAjaxInputData()' function removes standard WordPress protection by calling 'stripslashes()' on user input, while the 'filter_search' parameter is subsequently escaped using the deprecated 'wpdb->_escape()' function instead of prepared statements. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary SQL commands into a LIKE clause. By exploiting this, an attacker can extract sensitive data from the WordPress database. The vulnerability is present in versions up to and including 2.0.7.
Affected products
- Unlimited Elements Unlimited Elements for Elementor up to and including 2.0.7
Timeline
- 2026-05-14: disclosed: Vulnerability published to the CVE list.
- 2026-05-14: advisory: Wordfence published a vulnerability report.
References
- https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/tags/2.0.6/inc_php/unitecreator_actions.class.php
- https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/tags/2.0.6/inc_php/unitecreator_addons.class.php
- https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/tags/2.0.6/provider/provider_functions.class.php
- https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_actions.class.php
- https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_addons.class.php
- https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_addons.class.php
- https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/provider_db.class.php