CVE-2026-5486: Unlimited Elements Elementor SQLi Flaw

CVE-2026-5486 Overview

CVE-2026-5486 is an authenticated SQL Injection vulnerability in the Unlimited Elements for Elementor plugin for WordPress. The flaw affects all versions up to and including 2.0.7. Attackers exploit the data[filter_search] parameter passed to the get_cat_addons AJAX action. The plugin's normalizeAjaxInputData() function strips slashes from user input, defeating WordPress's wp_magic_quotes() protection. The parameter is then escaped with the deprecated wpdb->_escape() function and concatenated directly into a LIKE clause without prepared statements. Authenticated users with Contributor-level access or above can inject arbitrary SQL and extract sensitive data from the database.

Critical Impact

Authenticated attackers with Contributor-level access can extract sensitive information from the WordPress database through SQL injection in the get_cat_addons AJAX endpoint.

Affected Products

• Unlimited Elements for Elementor plugin for WordPress
• All versions up to and including 2.0.7
• WordPress sites with Contributor-level (or above) user accounts enabled

Discovery Timeline

• 2026-05-14 - CVE-2026-5486 published to NVD
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-5486

Vulnerability Analysis

The vulnerability resides in the get_cat_addons AJAX action handler exposed by the Unlimited Elements for Elementor plugin. The handler accepts a data[filter_search] parameter that is incorporated into a LIKE clause used to filter addon categories. The plugin relies on outdated escaping mechanisms instead of parameterized queries, allowing attackers to break out of the quoted string context and append arbitrary SQL fragments. Because the endpoint is reachable by any authenticated user who can retrieve a valid Elementor nonce, the practical barrier to exploitation is low on any site that grants Contributor-level access. Successful exploitation discloses database contents, including credential hashes and other sensitive records [CWE-89].

Root Cause

The root cause is a combination of three coding errors. First, normalizeAjaxInputData() calls stripslashes() on all input, removing the escaping that WordPress applies via wp_magic_quotes(). Second, the plugin uses the deprecated wpdb->_escape() function rather than wpdb->prepare(). Third, the escaped value is concatenated directly into the SQL query string rather than bound as a parameter. The deprecated escape function is insufficient to neutralize injection inside a LIKE clause, particularly when wildcard characters and unbalanced quotes are involved.

Attack Vector

An attacker authenticates to WordPress with at least Contributor permissions and obtains a valid nonce by loading the Elementor editor. The attacker then issues a crafted admin-ajax.php request invoking the get_cat_addons action with a malicious data[filter_search] payload. The injected SQL executes within the WordPress database context, enabling extraction of user records, options, and other tables through boolean-based or UNION-based techniques.

No verified public exploit code is available. Refer to the Wordfence Vulnerability Report and the affected source lines in the WordPress Plugin Code Reference for technical details.

Detection Methods for CVE-2026-5486

Indicators of Compromise

• POST requests to /wp-admin/admin-ajax.php containing action=get_cat_addons with suspicious characters in the data[filter_search] parameter, such as single quotes, UNION, SLEEP(, or -- comment markers.
• Unexpected database errors in PHP or MySQL logs originating from unitecreator_addons.class.php or provider_db.class.php.
• Elevated request volume to the get_cat_addons endpoint from a single Contributor-level account.

Detection Strategies

• Inspect web server access logs for admin-ajax.php calls invoking get_cat_addons and decode the filter_search parameter for SQL metacharacters.
• Deploy WAF rules that match known SQLi patterns in WordPress AJAX request bodies, focusing on LIKE clause escape sequences.
• Correlate authentication events for Contributor accounts with subsequent AJAX activity to identify low-privilege accounts performing reconnaissance.

Monitoring Recommendations

• Enable WordPress audit logging for user role assignments and new user registrations to identify staging of Contributor accounts.
• Monitor MySQL slow query and error logs for malformed LIKE patterns referencing the unlimited_elements tables.
• Alert on outbound database query response sizes that exceed normal baselines for the affected AJAX endpoint.

How to Mitigate CVE-2026-5486

Immediate Actions Required

• Update the Unlimited Elements for Elementor plugin to a version newer than 2.0.7 once the vendor publishes a fixed release.
• Audit existing WordPress accounts and remove or downgrade unnecessary Contributor-level (or higher) users.
• Review database access logs for indicators of prior exploitation and rotate WordPress administrator credentials if compromise is suspected.

Patch Information

The vendor's commit history is tracked in the WordPress Plugin Change Log. Apply the latest plugin release that replaces wpdb->_escape() with parameterized queries via wpdb->prepare() in the get_cat_addons handler. Verify the patch by confirming that the filter_search parameter is bound as a prepared statement parameter rather than concatenated.

Workarounds

• Restrict access to /wp-admin/admin-ajax.php?action=get_cat_addons via a WAF rule until the plugin is patched.
• Disable the Unlimited Elements for Elementor plugin on sites that allow open registration or grant Contributor access to untrusted users.
• Enforce strong authentication, including multi-factor authentication, for all WordPress accounts at Contributor level and above.

# Example ModSecurity rule to block SQLi attempts against the vulnerable AJAX action
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1026548601,msg:'Block CVE-2026-5486 SQLi attempt'"
  SecRule ARGS:action "@streq get_cat_addons" \
    "chain"
    SecRule ARGS:data[filter_search] "@rx (?i)(union(\s|/\*)+select|sleep\s*\(|--\s|';)" "t:none,t:urlDecodeUni"