PT-2026-26841 · Wpdive · Elementcamp

Itthidej Aramsri · Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-2503

Mitre

CVSS v3.1

6.5

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

The ElementCamp plugin for WordPress is vulnerable to time-based SQL Injection via the 'meta query[compare]' parameter in the 'tcg select2 search post' AJAX action in all versions up to, and including, 2.3.6. This is due to the user-supplied compare value being placed as an SQL operator in the query without validation against an allowlist of comparison operators. The value is passed through esc sql(), but since the payload operates as an operator (not inside quotes), esc sql() has no effect on payloads that don't contain quote characters. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-2503

Affected Products

Elementcamp

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-2503 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/cfb09dcd-f8ec-4b0a-ae77-4b4b7b54c93b?source=cve · Note
• https://plugins.trac.wordpress.org/browser/element-camp/trunk/elementor/extender/tcg-select2.php#L65 · Note
• https://plugins.trac.wordpress.org/browser/element-camp/tags/2.3.6/elementor/extender/tcg-select2.php#L65 · Note
• https://plugins.trac.wordpress.org/browser/element-camp/trunk/elementor/extender/tcg-select2.php#L83 · Note
• https://plugins.trac.wordpress.org/browser/element-camp/tags/2.3.6/elementor/extender/tcg-select2.php#L83 · Note