CVE-2024-5329: Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.109 - Authenticated (Contributor+) Blind SQL Injection via data[addonID] Parameter
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to blind SQL Injection via the ‘data[addonID]’ parameter in all versions up to, and including, 1.5.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5329?
CVE-2024-5329 is classified as a high severity vulnerability due to potential exploitation leading to unauthorized access to the database.
How do I fix CVE-2024-5329?
To fix CVE-2024-5329, update the Unlimited Elements For Elementor plugin to version 1.5.110 or later.
What is vulnerable in CVE-2024-5329?
CVE-2024-5329 affects the Unlimited Elements For Elementor plugin for WordPress, specifically the ‘data[addonID]’ parameter.
Which versions are affected by CVE-2024-5329?
All versions of the Unlimited Elements For Elementor plugin up to and including 1.5.109 are affected by CVE-2024-5329.
Can CVE-2024-5329 be exploited remotely?
Yes, CVE-2024-5329 can be exploited remotely by sending crafted requests to the affected plugin.