CVE-2024-5329: Unlimited Elements Elementor SQLi Flaw

CVE-2024-5329 Overview

CVE-2024-5329 is a blind SQL injection vulnerability in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress. The flaw affects all versions up to and including 1.5.109. It stems from insufficient escaping of the data[addonID] parameter and inadequate preparation of the underlying SQL query.

Authenticated attackers with Contributor-level access or higher can append additional SQL queries to the existing statement. This enables extraction of sensitive information from the WordPress database, including user credentials, session tokens, and configuration data.

Critical Impact
Authenticated Contributor-level attackers can execute arbitrary SQL against the WordPress database and exfiltrate sensitive data through blind SQL injection [CWE-89].

Affected Products

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin, versions up to and including 1.5.109
WordPress installations using the vulnerable plugin with Contributor-level or higher accounts enabled
Sites accepting user registrations that grant Contributor privileges by default

Discovery Timeline

2024-06-06 - CVE-2024-5329 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5329

Vulnerability Analysis

The vulnerability resides in the plugin's addon-handling logic within inc_php/unitecreator_addons.class.php. The data[addonID] parameter is passed from an HTTP request directly into a SQL statement without proper sanitization or parameterization. Because the query lacks wpdb::prepare() with correct placeholders, attacker-supplied SQL syntax is interpreted as part of the query.

This is classified as a blind SQL injection because the vulnerable endpoint does not return query results directly to the requester. Attackers infer database contents through boolean-based or time-based side channels, iterating character-by-character to reconstruct table contents such as wp_users password hashes and secret keys.

Exploitation requires authentication at the Contributor role or higher. WordPress sites that allow open registration or grant Contributor by default significantly expand the exploitable population.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. User input from data[addonID] is concatenated into a SQL query string rather than bound as a parameter, allowing SQL syntax injection.

Attack Vector

The attack is remote and network-based over standard HTTP/HTTPS. An authenticated attacker submits a crafted request to the plugin's AJAX handler with a malicious data[addonID] value containing SQL payloads such as UNION SELECT clauses or time-delay functions like SLEEP().

The vulnerability manifests in the addon retrieval function referenced in the WordPress Plugin Code Snippet. See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2024-5329

Indicators of Compromise

HTTP POST requests to admin-ajax.php containing the data[addonID] parameter with SQL keywords such as SELECT, UNION, SLEEP, BENCHMARK, or IF(
Anomalously long response times on requests handled by the Unlimited Elements plugin, indicative of time-based blind SQL injection
High-volume requests from a single authenticated Contributor account targeting plugin AJAX endpoints
Database error entries in PHP or web server logs referencing plugin query paths

Detection Strategies

Inspect web server access logs for data[addonID] values containing URL-encoded SQL metacharacters like %27, %20UNION, or SLEEP(
Deploy a Web Application Firewall (WAF) rule matching SQL injection signatures against the vulnerable parameter
Correlate authenticated session activity with query anomalies in MySQL general or slow query logs

Monitoring Recommendations

Enable WordPress audit logging to record Contributor-level account creation and privilege changes
Monitor for newly registered accounts that immediately interact with plugin AJAX endpoints
Alert on repeated failed or malformed queries originating from the wp-admin interface

How to Mitigate CVE-2024-5329

Immediate Actions Required

Update the Unlimited Elements For Elementor plugin to version 1.5.110 or later, which addresses the parameter sanitization gap
Audit all WordPress accounts and remove or downgrade unnecessary Contributor-or-higher privileges
Rotate WordPress secret keys in wp-config.php and force password resets if exploitation is suspected
Review database logs and wp_users table for signs of unauthorized enumeration

Patch Information

The vendor released a fix documented in the WordPress Plugin Changeset. The patch adds proper escaping and parameterization to the affected SQL query path. Administrators should apply the update via the WordPress plugin manager or verify automatic updates are enabled.

Workarounds

Disable the Unlimited Elements For Elementor plugin until the patched version can be deployed
Restrict Contributor and higher role assignments and disable open user registration on public-facing sites
Deploy WAF rules to block requests containing SQL metacharacters in the data[addonID] parameter
Restrict access to admin-ajax.php from untrusted networks where feasible

bash

# Example WAF rule (ModSecurity) blocking SQL injection payloads in data[addonID]
SecRule ARGS:"data[addonID]" "@rx (?i)(union(\s|\+)+select|sleep\s*\(|benchmark\s*\(|--|;)" \
    "id:1005329,phase:2,deny,status:403,log,msg:'CVE-2024-5329 SQLi attempt on Unlimited Elements addonID'"