SQL Injection Vulnerability in Unlimited Elements For Elementor Plugin
CVE-2024-4779

8.8HIGH

Key Information:

Vendor
Wordpress
Status
Unlimited Elements For Elementor (free Widgets, Addons, Templates)
Vendor
CVE Published:
23 May 2024

Summary

The Unlimited Elements For Elementor plugin for WordPress is susceptible to an SQL Injection vulnerability, primarily affecting versions up to and including 1.5.107. This issue arises from inadequate escaping of user-supplied parameters, particularly the 'data[post_ids][0]' parameter. Authenticated attackers with contributor-level access or higher can exploit this vulnerability to inject additional SQL queries into the existing ones, potentially extracting sensitive data from the database and compromising site integrity.

Affected Version(s)

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) * <= 1.5.107

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3090199/unli...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mohamed Awad
.