CVE-2026-18561: Unlimited Elements For Elementor SQL Injection

CVE-2026-18561 Overview

CVE-2026-18561 is a SQL injection vulnerability in the Unlimited Elements For Elementor plugin for WordPress, affecting all versions up to and including 2.0.16. The flaw resides in the handling of the addontype parameter, which flows into the getWhereString() function without adequate escaping or query preparation. Unauthenticated attackers can inject arbitrary SQL fragments into the WHERE clause of an existing query. Successful exploitation allows extraction of sensitive information from the WordPress database, including credentials and session data. This vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated attackers can exfiltrate arbitrary data from the WordPress database, including user hashes and administrative session artifacts, without any user interaction.

Affected Products

Unlimited Elements For Elementor (WordPress plugin) — versions up to and including 2.0.16
WordPress sites where the plugin is installed and activated
Any hosting environment exposing the plugin's AJAX endpoints to the public internet

Discovery Timeline

2026-09-11 - CVE-2026-18561 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-18561

Vulnerability Analysis

The vulnerability originates in the plugin's database abstraction layer, specifically the getWhereString() function defined in inc_php/framework/db.class.php. When the addontype parameter is submitted as an array, the function reads element zero of the array and treats it verbatim as the SQL comparison operator. That value is concatenated directly into the WHERE clause without escaping or parameter binding.

Compounding the flaw, normalizeAjaxInputData() strips WordPress's magic_quotes protection from the input before it reaches the query builder. This removes the platform's default backslash escaping and leaves the raw attacker-controlled string in the SQL statement. The result is a classic union-based or boolean-based blind SQL injection reachable by unauthenticated clients over the network.

Root Cause

The root cause is a type-confusion issue combined with missing input sanitization. The getWhereString() function assumes the operator argument is a trusted string constant. When callers propagate user input through the addontype parameter as an array, the plugin uses $value[0] directly in query construction. WordPress's $wpdb->prepare() interface is not applied to the operator segment, so the input is never bound as a typed placeholder.

Attack Vector

The attack requires no authentication and no user interaction. An attacker sends a crafted HTTP request to the plugin's public AJAX handler, supplying addontype[] as an array whose first element contains SQL syntax. The injected fragment closes the intended comparison and appends attacker-controlled clauses such as UNION SELECT statements against wp_users. The vulnerable code paths are referenced in unitecreator_actions.class.php, unitecreator_addon.class.php, unitecreator_addons.class.php, and provider/provider_functions.class.php. See the Wordfence Vulnerability Report for the disclosed request pattern.

Detection Methods for CVE-2026-18561

Indicators of Compromise

HTTP POST requests to admin-ajax.php containing addontype[] array parameters with SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA.
Unexpected outbound queries reading from wp_users, wp_usermeta, or wp_options originating from the web application user.
Web server access logs showing repeated requests to Unlimited Elements AJAX actions from a single source IP within short time windows.
Database slow-query log entries containing malformed WHERE clauses referencing addontype.

Detection Strategies

Deploy web application firewall (WAF) rules that flag array-type parameters supplied where scalar values are expected on plugin AJAX endpoints.
Correlate WordPress access logs with database query logs to identify suspicious SELECT patterns tied to AJAX invocations.
Inspect PHP error logs for mysqli warnings referencing the getWhereString() call stack, which often accompany injection probes.

Monitoring Recommendations

Enable MySQL general query logging temporarily on affected hosts to capture the full SQL statements being executed during exploitation attempts.
Monitor for privilege escalation indicators such as newly created administrator accounts in wp_users following suspicious request bursts.
Alert on outbound egress from the web tier to unusual destinations, which can indicate data exfiltration after successful extraction.

How to Mitigate CVE-2026-18561

Immediate Actions Required

Update the Unlimited Elements For Elementor plugin to the version released in changeset 3661670, which supersedes vulnerable version 2.0.16.
Audit wp_users and wp_options for unauthorized modifications, and force password resets for all administrative accounts.
Rotate WordPress secret keys and salts in wp-config.php to invalidate any session cookies that may have been derived from stolen data.

Patch Information

The vendor addressed the vulnerability in the plugin trunk via WordPress changeset 3661670. The fix hardens the getWhereString() function and ensures addontype input is validated as a scalar before being concatenated into SQL. Site administrators should upgrade through the WordPress plugin manager or by pulling the patched release from the plugin repository. Review the patched source in db.class.php to confirm the deployed version contains the sanitization changes.

Workarounds

Restrict access to wp-admin/admin-ajax.php actions belonging to Unlimited Elements at the WAF or reverse proxy layer until patching completes.
Deactivate the Unlimited Elements For Elementor plugin on production sites that cannot be updated immediately.
Enforce least-privilege database credentials for WordPress, removing FILE and cross-database SELECT privileges from the application user.

bash

# Configuration example: block array-type addontype parameters at the WAF
# ModSecurity rule example
SecRule ARGS_NAMES "@rx ^addontype\[\]$" \
    "id:1026018561,phase:2,deny,status:403,\
    msg:'CVE-2026-18561 Unlimited Elements SQLi attempt',\
    tag:'attack-sqli'"