PT-2026-40848 · WordPress · Unlimited Elements For Elementor
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Unlimited Elements for Elementor versions prior to 2.0.8
Description
Insufficient input sanitization and the use of deprecated escaping functions combined with direct string concatenation in SQL query construction allow authenticated attackers with Contributor-level access and above to inject arbitrary SQL commands and extract sensitive information from the database. The issue occurs in the 'get cat addons' AJAX action via the
data[filter search] parameter. The normalizeAjaxInputData() function calls stripslashes() on user input, which removes protection from the wp magic quotes() function. The filter search parameter is then processed using the deprecated wpdb-> escape() function and concatenated into a LIKE clause without prepared statements.Recommendations
Update to a version later than 2.0.7.
Avoid using the
data[filter search] parameter in the 'get cat addons' AJAX action until the update is applied.Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Unlimited Elements For Elementor