SQL Injection Vulnerability in Unlimited Elements for Elementor Plugin by WordPress

CVE-2026-5486

What is CVE-2026-5486?

The Unlimited Elements for Elementor plugin for WordPress allows authenticated attackers to exploit SQL injection vulnerabilities via the 'data[filter_search]' parameter in the get_cat_addons AJAX action. The flaw arises from inadequate input sanitization and the obsolete escaping functions that are used with direct string concatenation in SQL queries. The attack vector is aggravated by the normalizeAjaxInputData() function, which strips necessary escape characters from user inputs, negating the protections that WordPress typically provides. As a result, attackers with Contributor-level access can execute arbitrary SQL commands, potentially leading to the extraction of sensitive data from the database.

References