CVE-2024-6166: Unlimited Elements for Elementor SQLi Flaw

CVE-2024-6166 Overview

CVE-2024-6166 is a time-based SQL Injection vulnerability [CWE-89] in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress. The flaw affects all versions up to and including 1.5.112. The plugin fails to properly escape the addons_order parameter and does not adequately prepare the underlying SQL query. Authenticated attackers with Contributor-level access or above, who have been granted plugin setting edit permissions by an administrator, can append additional SQL statements to existing queries. Successful exploitation allows extraction of sensitive database information, including user credentials and configuration data.

Critical Impact
Authenticated attackers with Contributor-level access can inject arbitrary SQL through the addons_order parameter, enabling extraction of sensitive data from the WordPress database.

Affected Products

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin, versions up to and including 1.5.112
WordPress sites running the vulnerable plugin with Contributor-level or higher user accounts
Multisite WordPress installations where the plugin is network-activated

Discovery Timeline

2024-07-09 - CVE-2024-6166 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6166

Vulnerability Analysis

The vulnerability resides in the unitecreator_addons.class.php file of the Unlimited Elements For Elementor plugin. The addons_order parameter passes user-controlled input directly into a SQL query without sufficient escaping or parameterization. This allows attackers to append additional SQL syntax that the database interprets as part of the original query.

The classification as time-based SQL Injection indicates that the query results are not directly returned to the attacker. Instead, attackers extract data by injecting conditional time-delay functions such as SLEEP() and observing server response times. This technique enables byte-by-byte extraction of database contents including WordPress user credentials stored in wp_users and secrets stored in wp_options.

Exploitation requires authentication at Contributor level or above and explicit administrator authorization to edit plugin settings. This precondition narrows the attacker population but does not prevent exploitation by compromised low-privilege accounts.

Root Cause

The root cause is insufficient input sanitization combined with unsafe SQL query construction. The plugin concatenates the addons_order value into the SQL statement without using WordPress's $wpdb->prepare() method or equivalent parameterized query mechanisms. Any special SQL characters passed through this parameter are interpreted as query syntax rather than data.

Attack Vector

The attack proceeds over the network against an authenticated session. An attacker with Contributor privileges and plugin edit permissions submits a crafted HTTP request containing malicious SQL syntax in the addons_order parameter. The vulnerable code path invokes the SQL query through the plugin's addon ordering functionality, executing the attacker's injected statements against the WordPress database.

The vulnerability mechanism is described in the WordPress Plugin Code Review and analyzed in the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2024-6166

Indicators of Compromise

HTTP POST requests to WordPress admin-ajax endpoints containing SQL keywords such as SLEEP, BENCHMARK, UNION SELECT, or IF( in the addons_order parameter
Unusually long response times from requests targeting Unlimited Elements plugin endpoints, indicating time-based SQL injection probing
Repeated authenticated requests from Contributor or Author accounts to plugin configuration endpoints
Unexpected database queries in MySQL slow query logs referencing plugin tables with concatenated conditional expressions

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect POST parameters for SQL injection payloads targeting the addons_order parameter
Enable WordPress audit logging to capture parameter values submitted to plugin settings pages
Monitor database query patterns for statements originating from the plugin containing time-delay functions
Baseline normal request patterns to Unlimited Elements endpoints and alert on statistical anomalies

Monitoring Recommendations

Log all HTTP requests to /wp-admin/admin-ajax.php with parameter values for forensic review
Correlate authenticated user activity with database query performance metrics
Alert on Contributor or Author accounts accessing plugin configuration endpoints outside normal working hours
Retain WordPress access logs and MySQL general query logs for at least 90 days to support incident investigation

How to Mitigate CVE-2024-6166

Immediate Actions Required

Update the Unlimited Elements For Elementor plugin to a version later than 1.5.112 that includes the fix from changeset 3112307
Audit all WordPress user accounts with Contributor role or above and remove unnecessary plugin edit permissions
Review administrator grants of plugin setting edit permissions to lower-privileged users
Rotate WordPress administrator credentials, database passwords, and API keys if compromise is suspected

Patch Information

The vendor released a fix in changeset 3112307 on the WordPress plugin repository. The patch addresses versions above 1.5.112. Site administrators should update through the WordPress plugin manager or apply the patched files manually. Verify the installed version after update by checking the plugin metadata in the WordPress admin dashboard.

Workarounds

Revoke plugin setting edit permissions for all non-administrator users until the patch is applied
Deploy WAF rules that block requests containing SQL metacharacters in the addons_order parameter
Restrict access to WordPress admin endpoints by IP address using web server configuration
Temporarily deactivate the Unlimited Elements For Elementor plugin if patching cannot be performed immediately

bash

# Example WAF rule (ModSecurity) blocking SQL injection payloads in addons_order
SecRule ARGS:addons_order "@rx (?i)(sleep|benchmark|union.*select|if\(|case\s+when)" \
    "id:1006166,phase:2,deny,status:403,msg:'CVE-2024-6166 SQLi attempt in addons_order'"