SQL Injection Vulnerability in Unlimited Elements For Elementor Plugin by WordPress

CVE-2026-18561

What is CVE-2026-18561?

The Unlimited Elements For Elementor plugin for WordPress exposes a SQL Injection vulnerability through the 'addontype' parameter in versions up to and including 2.0.16. This flaw arises from inadequate escaping of user-supplied input and poor preparation of the SQL query in the getWhereString() function. When the parameter is provided as an array, the first element is directly used as an SQL comparison operator, concatenated into the WHERE clause without proper sanitization. Additionally, the normalizeAjaxInputData() function removes WordPress's magic_quotes protection, allowing unauthenticated attackers to inject malicious SQL queries. This can lead to unauthorized access to sensitive information stored in the database, posing a significant risk to websites utilizing this plugin.

References