{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/unlimited-elements/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:unlimited-elements:unlimited_elements_for_elementor:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-18561"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Unlimited Elements For Elementor (\u003c= 2.0.16)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Unlimited Elements"],"content_html":"\u003cp\u003eThe Unlimited Elements For Elementor plugin for WordPress, in versions up to and including 2.0.16, contains a critical SQL injection vulnerability. The flaw originates within the getWhereString() function, which fails to properly sanitize user-supplied input when the 'addontype' parameter is provided as an array. Specifically, the first element of this array is concatenated directly into the SQL WHERE clause without sufficient escaping or preparation. Furthermore, the normalizeAjaxInputData() function strips WordPress magic_quotes protection, further exacerbating the injection vector. An unauthenticated attacker can exploit this flaw by supplying a crafted malicious array to the vulnerable parameter, enabling the injection of arbitrary SQL commands. Successful exploitation grants the attacker the ability to manipulate database queries, potentially leading to unauthorized data exfiltration or complete compromise of the WordPress database. Defenders should audit logs for suspicious POST/GET requests targeting the addontype parameter.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-18561 allows unauthenticated remote attackers to execute arbitrary SQL commands on the underlying database. This can lead to the unauthorized disclosure of sensitive information, including user credentials, configuration data, and site content. Given the widespread use of Elementor plugins in the WordPress ecosystem, this vulnerability poses a significant risk of data breach for affected sites.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Unlimited Elements For Elementor plugin to the latest version immediately to remediate CVE-2026-18561.\u003c/li\u003e\n\u003cli\u003eImplement a Web Application Firewall (WAF) to detect and block incoming HTTP requests containing SQL injection payloads targeting the 'addontype' parameter.\u003c/li\u003e\n\u003cli\u003eAudit database logs for unusual query patterns or unexpected error messages originating from the plugin's affected PHP functions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-11T05:11:46Z","date_published":"2026-09-11T05:11:46Z","id":"https://feed.craftedsignal.io/briefs/2026-09-cve-2026-18561/","summary":"The Unlimited Elements For Elementor WordPress plugin contains an unauthenticated SQL injection vulnerability via the addontype parameter, allowing attackers to perform unauthorized database extraction.","title":"SQL Injection Vulnerability in Unlimited Elements For Elementor","url":"https://feed.craftedsignal.io/briefs/2026-09-cve-2026-18561/"}],"language":"en","title":"CraftedSignal Threat Feed - Unlimited Elements","version":"https://jsonfeed.org/version/1.1"}