SQL Injection Vulnerability in Unlimited Elements For Elementor

The Unlimited Elements For Elementor plugin for WordPress, in versions up to and including 2.0.16, contains a critical SQL injection vulnerability. The flaw originates within the getWhereString() function, which fails to properly sanitize user-supplied input when the 'addontype' parameter is provided as an array. Specifically, the first element of this array is concatenated directly into the SQL WHERE clause without sufficient escaping or preparation. Furthermore, the normalizeAjaxInputData() function strips WordPress magic_quotes protection, further exacerbating the injection vector. An unauthenticated attacker can exploit this flaw by supplying a crafted malicious array to the vulnerable parameter, enabling the injection of arbitrary SQL commands. Successful exploitation grants the attacker the ability to manipulate database queries, potentially leading to unauthorized data exfiltration or complete compromise of the WordPress database. Defenders should audit logs for suspicious POST/GET requests targeting the addontype parameter.

Impact

Successful exploitation of CVE-2026-18561 allows unauthenticated remote attackers to execute arbitrary SQL commands on the underlying database. This can lead to the unauthorized disclosure of sensitive information, including user credentials, configuration data, and site content. Given the widespread use of Elementor plugins in the WordPress ecosystem, this vulnerability poses a significant risk of data breach for affected sites.

Recommendation

• Update the Unlimited Elements For Elementor plugin to the latest version immediately to remediate CVE-2026-18561.
• Implement a Web Application Firewall (WAF) to detect and block incoming HTTP requests containing SQL injection payloads targeting the 'addontype' parameter.
• Audit database logs for unusual query patterns or unexpected error messages originating from the plugin's affected PHP functions.