Time-Based SQL Injection Vulnerability in Unlimited Elements For Elementor

CVE-2024-3055

Summary

The Unlimited Elements For Elementor plugin for WordPress is susceptible to time-based SQL Injection through the ‘id’ parameter across all releases up to and including version 1.5.102. This vulnerability arises from inadequate escaping of the user-supplied parameter alongside ineffective preparation of SQL queries. As a result, authenticated attackers with contributor access or higher can inject additional SQL commands into existing queries. This exploitation may permit attackers to retrieve sensitive data from the database, posing significant risks to the integrity and confidentiality of user information.

References