CVE-2024-30496: Element Pack Elementor SQLi Vulnerability

CVE-2024-30496 Overview

CVE-2024-30496 is a SQL injection vulnerability in the BdThemes Element Pack Elementor Addons plugin for WordPress. The flaw stems from improper neutralization of special elements used in SQL commands [CWE-89]. It affects all versions of Element Pack Elementor Addons up to and including 5.5.3. An authenticated attacker with low privileges can inject crafted SQL statements over the network to read, modify, or destroy database contents. The vulnerability was published to the National Vulnerability Database on March 29, 2024, and cataloged by Patchstack.

Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the WordPress database, exposing site content, user credentials, and session data.

Affected Products

BdThemes Element Pack Elementor Addons (Lite) versions through 5.5.3
WordPress sites running the vulnerable plugin
Deployments using CPE cpe:2.3:a:bdthemes:element_pack:*:*:*:*:lite:wordpress:*:*

Discovery Timeline

2024-03-29 - CVE-2024-30496 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30496

Vulnerability Analysis

The Element Pack Elementor Addons plugin extends the Elementor page builder with additional widgets and modules. One or more of its request handlers pass user-supplied input into SQL queries without adequate sanitization or parameterization. An attacker submits crafted parameters that break out of the intended query context and append arbitrary SQL clauses.

Exploitation requires network access and low-privilege authentication to WordPress. No user interaction is needed. Successful injection yields high impact to confidentiality, integrity, and availability of the underlying database. Attackers can extract wp_users credentials, tamper with post content, or drop tables to disrupt the site.

Root Cause

The root cause is improper neutralization of special SQL elements [CWE-89]. The plugin concatenates untrusted request parameters directly into query strings rather than using prepared statements or WordPress's $wpdb->prepare() API with proper placeholders. Special characters such as single quotes and comment sequences are not escaped before reaching the SQL parser.

Attack Vector

The attack vector is network-based against the WordPress admin or AJAX surface exposed by the plugin. A subscriber-level or higher authenticated user issues an HTTP request containing SQL metacharacters in a plugin-controlled parameter. The injected payload executes with the privileges of the WordPress database user, which typically has full DML and DDL rights on the site database.

No verified public proof-of-concept code is available at this time. Refer to the Patchstack SQL Injection Vulnerability advisory for additional technical context.

Detection Methods for CVE-2024-30496

Indicators of Compromise

HTTP requests to Element Pack endpoints containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP(
Unexpected outbound queries or errors from the WordPress database logged in debug.log referencing plugin handlers
New or modified administrator accounts in wp_users that cannot be attributed to legitimate activity
Anomalous authenticated sessions from low-privilege accounts hitting plugin AJAX actions repeatedly

Detection Strategies

Deploy a Web Application Firewall (WAF) rule set that flags SQL injection patterns targeting /wp-admin/admin-ajax.php and Elementor widget endpoints
Enable MySQL general query logging on staging environments to identify malformed queries originating from plugin code
Correlate authentication events with plugin request activity to surface low-privilege accounts probing SQL parameters

Monitoring Recommendations

Alert on HTTP 500 responses from Element Pack routes, which often indicate injection attempts triggering SQL errors
Monitor changes to wp_options, wp_users, and wp_usermeta outside standard administrative workflows
Track plugin version inventory across WordPress fleets to identify hosts still running versions at or below 5.5.3

How to Mitigate CVE-2024-30496

Immediate Actions Required

Update BdThemes Element Pack Elementor Addons to a version later than 5.5.3 as published by the vendor
Audit WordPress user accounts and revoke any unfamiliar or dormant low-privilege accounts that could be leveraged for authenticated access
Rotate WordPress administrator passwords and database credentials if compromise is suspected
Review database contents and web server access logs for signs of prior exploitation

Patch Information

The vendor advisory catalogued by Patchstack indicates the vulnerability affects versions through 5.5.3. Administrators should install the latest release of Element Pack Elementor Addons from the official plugin repository. See the Patchstack advisory for fixed-version details.

Workarounds

Temporarily deactivate the Element Pack plugin until patching is complete
Restrict access to /wp-admin/ and admin-ajax.php by IP allowlist at the reverse proxy or WAF
Enforce least-privilege principles by limiting subscriber and contributor role registration on the site
Deploy virtual patching rules through a WAF to block SQL metacharacters in plugin parameters

bash

# Example WAF rule (ModSecurity) to block SQLi patterns on plugin endpoints
SecRule REQUEST_URI "@contains element-pack" \
  "chain,id:1030496,phase:2,deny,status:403,log,msg:'CVE-2024-30496 SQLi attempt'"
  SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|--\s|';)" "t:none"