Vulnerability in Elementor Plugin Allows Attackers to Extract Sensitive Information from Database

CVE-2024-6166

Summary

The Unlimited Elements For Elementor plugin for WordPress is susceptible to a time-based SQL Injection when processing the 'addons_order' parameter. This flaw arises from inadequate escaping of user-supplied data and deficient preparation within the SQL query. Authenticated users with Contributor-level access or higher, who possess permissions to edit plugin settings assigned by an administrator, can exploit this vulnerability to inject additional SQL queries into existing ones. This can lead to unauthorized data retrieval from the database, potentially exposing sensitive information.

References