CVE-2026-92923: Unlimited Elements for Elementor SQLi Flaw

CVE-2026-92923 Overview

CVE-2026-92923 is a blind SQL injection vulnerability in the Unlimited Elements for Elementor WordPress plugin before version 2.0.21. The plugin fails to sanitize and escape a user-controlled parameter before using it in a SQL statement. Authenticated users with low privileges can inject SQL and read arbitrary data from the WordPress database. Versions prior to 2.0.18 allow exploitation by Subscriber-level accounts. From 2.0.18 onward, exploitation requires at least a Contributor role. The weakness is classified as Improper Neutralization of Special Elements used in an SQL Command [CWE-89].

Critical Impact
Authenticated attackers can exfiltrate sensitive database contents, including user credentials and configuration secrets, through blind SQL injection.

Affected Products

Unlimited Elements for Elementor WordPress plugin versions before 2.0.21
Versions before 2.0.18 exploitable by Subscriber-level users
Versions 2.0.18 through 2.0.20 exploitable by Contributor-level users

Discovery Timeline

2026-10-03 - CVE-2026-92923 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-92923

Vulnerability Analysis

The Unlimited Elements for Elementor plugin exposes an authenticated endpoint that accepts a parameter and concatenates its value into a SQL query. The plugin does not apply sanitization through esc_sql() or parameterized queries using $wpdb->prepare(). An authenticated attacker can inject conditional SQL payloads that cause the backend to return observable differences in response behavior or timing. By iterating over these conditions, the attacker reconstructs database contents one bit at a time. Target data typically includes rows from wp_users, wp_usermeta, and wp_options, where password hashes, session tokens, and API keys reside.

Root Cause

The root cause is missing input neutralization before SQL execution. User-supplied input flows directly into a query string without type casting, allow-listing, or prepared statement binding. This matches the pattern described by CWE-89. Prior to version 2.0.18, the vulnerable endpoint was reachable by Subscriber accounts, which anyone can register when open registration is enabled. The maintainers removed Subscriber access in 2.0.18, raising the privilege bar to Contributor, before fully patching the injection in 2.0.21.

Attack Vector

Exploitation is network-based and requires an authenticated session on the WordPress site. The attacker sends crafted HTTP requests to the vulnerable plugin endpoint with SQL metacharacters embedded in the parameter. Because the injection is blind, attackers typically use boolean-based or time-based payloads to infer query results. Automated tooling such as sqlmap can enumerate schemas and extract records once a valid session cookie is supplied. Refer to the WPScan Vulnerability Analysis for technical details.

Detection Methods for CVE-2026-92923

Indicators of Compromise

HTTP requests from authenticated low-privilege accounts to Unlimited Elements plugin AJAX endpoints containing SQL keywords such as UNION, SELECT, SLEEP, or BENCHMARK
Repeated requests from a single Subscriber or Contributor account with incremental parameter mutations
Anomalous response time variance on plugin endpoints indicating time-based blind injection
Spikes in wp_users or wp_options read activity in MySQL general or slow query logs

Detection Strategies

Enable WordPress query logging or MySQL general log and alert on queries referencing plugin tables with suspicious conditional expressions
Deploy a web application firewall rule set that inspects authenticated POST requests to /wp-admin/admin-ajax.php for SQL injection signatures
Correlate low-privilege account activity against sensitive database read patterns in SIEM telemetry

Monitoring Recommendations

Audit active Subscriber and Contributor accounts and disable unused registrations
Monitor plugin version inventory across WordPress deployments and flag installations below 2.0.21
Track outbound data volume from the database host for signs of staged exfiltration

How to Mitigate CVE-2026-92923

Immediate Actions Required

Upgrade the Unlimited Elements for Elementor plugin to version 2.0.21 or later on all WordPress sites
Disable open user registration if Subscriber-level accounts are not required for site operation
Rotate credentials, API keys, and secrets stored in wp_options if exploitation is suspected
Review user accounts for unexpected Subscriber or Contributor registrations created before patching

Patch Information

The vendor fixed the SQL injection in version 2.0.21 of the Unlimited Elements for Elementor plugin. Version 2.0.18 reduced exposure by removing Subscriber-level access to the vulnerable endpoint, but did not eliminate the injection flaw. Administrators must apply 2.0.21 to fully remediate CVE-2026-92923. See the WPScan Vulnerability Analysis for patch confirmation.

Workarounds

Deactivate the Unlimited Elements for Elementor plugin until the patched version is installed
Restrict access to /wp-admin/admin-ajax.php through WAF rules that block SQL injection patterns on authenticated plugin requests
Enforce the principle of least privilege by auditing role assignments and removing unnecessary Contributor accounts

bash

# Configuration example: upgrade plugin via WP-CLI
wp plugin update unlimited-elements-for-elementor --version=2.0.21
wp plugin list --name=unlimited-elements-for-elementor --fields=name,status,version