CVE-2026-18561 in Unlimited Elements for Elementor Plugin
Summary
by MITRE • 09/11/2026
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in the getWhereString() function; when the parameter is supplied as an array, element zero is used verbatim as the SQL comparison operator and concatenated into the WHERE clause without sanitization, while normalizeAjaxInputData() strips WordPress's magic_quotes protection from the value. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/11/2026
The Unlimited Elements For Elementor plugin for WordPress contains a critical SQL injection vulnerability affecting versions up to and including 2.0.16. This flaw resides within the getWhereString() function, which is responsible for constructing dynamic SQL queries based on user-supplied input. The root cause of this vulnerability is insufficient sanitization and validation of the addontype parameter. Specifically, when an attacker supplies the addontype parameter as a PHP array, the plugin logic extracts the first element (index zero) from that array and uses it verbatim within the SQL query construction process. This design choice bypasses standard input filtering mechanisms because the value is not treated as a simple string but rather as part of the SQL syntax itself, allowing for structural manipulation of the database command.
The technical mechanism exploits how WordPress handles magic quotes through the normalizeAjaxInputData() function. In older PHP environments or specific configurations where magic_quotes_gpc was enabled, this function strips those protective slashes from user input to prevent double-escaping issues in modern applications. However, in this context, stripping these protections without subsequent proper escaping leaves the data raw and dangerous when it is directly concatenated into a SQL WHERE clause. Because the extracted array element serves as the comparison operator or part of the query structure rather than just a value parameter, an attacker can inject arbitrary SQL commands that alter the logic of the original query. This allows for blind SQL injection techniques where the attacker can infer database contents by observing response times or error messages resulting from injected boolean conditions.
The operational impact of this vulnerability is severe due to its unauthenticated nature. Attackers do not need valid credentials or a logged-in session on the WordPress site to exploit this flaw, significantly lowering the barrier for entry and increasing the likelihood of automated attacks targeting exposed instances. By leveraging this SQL injection vector, malicious actors can extract sensitive information stored in the database, including user passwords, administrative credentials, personal data, and other proprietary content. This compromise undermines the confidentiality and integrity of the entire web application infrastructure hosting the vulnerable plugin. The ability to append additional queries means that attackers could potentially escalate privileges or modify existing records if the underlying SQL dialect supports stacked queries, although extraction remains the primary risk vector in this specific implementation.
From a classification perspective, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command and is associated with ATT&CK technique T1059 Command and Scripting Interpreter if further exploitation leads to remote code execution via database functions like INTO OUTFILE or xp_cmdshell. To mitigate this risk, site administrators must immediately update the Unlimited Elements For Elementor plugin to a version newer than 2.0.16 where these input validation checks have been corrected. In addition to patching, it is advisable to implement Web Application Firewall rules that detect and block anomalous SQL syntax patterns in POST requests targeting WordPress AJAX endpoints. Regular security audits and adherence to secure coding practices such as using prepared statements with parameterized queries will prevent similar vulnerabilities from being introduced in future development cycles.