CVE-2026-18561: Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injection
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in the getWhereString() function; when the parameter is supplied as an array, element zero is used verbatim as the SQL comparison operator and concatenated into the WHERE clause without sanitization, while normalizeAjaxInputData() strips WordPress's magicquotes protection from the value. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: Unlimited Elements For Elementorto a version that resolves this vulnerability.Fixed in 2.0.16 - Compensating control
Block unauthenticated access to the plugin’s AJAX endpoint that processes the addontype parameter (e.g., via WAF/ACL) until the vulnerable plugin version is upgraded.
Event History
Frequently Asked Questions
Does an attacker need a WordPress account or any user interaction to exploit this issue?
No. The vulnerability is exploitable by unauthenticated attackers and does not require user interaction.
Which installations are in scope?
Unlimited Elements For Elementor versions up to and including 2.0.16 are affected.
What could an attacker obtain through successful exploitation?
An attacker can append SQL to existing queries and use it to extract sensitive information from the WordPress database.