Blind SQL Injection Vulnerability in Unlimited Elements For Elementor

CVE-2024-5329

Summary

The Unlimited Elements for Elementor plugin on WordPress is susceptible to a blind SQL injection attack stemming from improper handling of the ‘data[addonID]’ parameter. This vulnerability affects all versions up to and including 1.5.109, allowing authenticated users with Contributor-level access or higher to manipulate existing SQL queries. By exploiting this flaw, attackers can inject additional SQL commands, potentially leading to unauthorized access to sensitive data stored in the database. This security weakness underscores the necessity for developers to implement proper input validation and query sanitization measures to safeguard against SQL injection risks.

References