What is the CVSS score of CVE-2026-103355?

CVE-2026-103355 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of Unlimited Elements are affected by CVE-2026-103355?

Organizations using the Unlimited Elements For Elementor plugin (versions up to 2.0.20) on their WordPress sites face a critical risk (CVE-2026-103355, CVSS 9.3) of unauthorized database access.

How to fix or mitigate CVE-2026-103355?

Within 24 hours, identify all instances of the Unlimited Elements For Elementor plugin versions up to 2.0.20 and disable or remove the plugin if not essential. If the plugin cannot be disabled, implement virtual patching via a Web Application Firewall (WAF) to block SQL injection patterns and restrict access to plugin files. Within 7 days, conduct a thorough review of database logs for any signs of unauthorized access or data exfiltration, and apply any temporary mitigations provided by the vendor or security community. Within 30 days, monitor vendor channels for a patched version (beyond 2.0.20) and apply it immediately upon release; if no patch is forthcoming, evaluate alternative plugins and plan for migration.

Unlimited Elements CVE-2026-103355

EUVD-2026-92089 CRITICAL

SQL Injection (CWE-89)

2026-10-04 Patchstack

GHSA-rcjh-9qxp-82pg

WordPress SQLi Unlimited Elements For Elementor Free Widgets Addons Templates Wordpress Plugin Unlimited Elements

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Network-reachable blind SQLi with low complexity; PR:N retained per source vector though plugin SQLi often needs low auth; confidentiality high via DB read, no integrity, minor availability.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Oct 04, 2026 - 09:17 vuln.today

CVE Published

Oct 04, 2026 - 08:00 cve.org

CRITICAL 9.3

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.

Articles & Coverage 2

News 6 New WordPress Vulnerabilities - 1 Critical, 5 High Severity Oct 05, 2026 News Critical Blind SQL Injection in WordPress Unlimited Elements For Elementor - CVE-2026-103355 Oct 04, 2026

AnalysisAI

Blind SQL injection in the Unlimited Elements For Elementor plugin (versions up to 2.0.20) allows remote attackers to extract sensitive information from the WordPress database by inferring query results. The CVSS vector indicates unauthenticated exploitation (PR:N) with no user interaction, but the specific vulnerable endpoint and whether authentication is truly not required remain unconfirmed. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin installed and active at version 2.0.20 or earlier on a WordPress site, with the vulnerable plugin endpoint/parameter network-reachable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a credible high-priority issue for WordPress operators running the affected plugin. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade the Unlimited Elements For Elementor plugin to a version later than 2.0.20; no exact patched version is specified in the available data, but the vulnerability is known to affect versions up to 2.0.20, and later releases should contain the fix. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all instances of the Unlimited Elements For Elementor plugin versions up to 2.0.20 and disable or remove the plugin if not essential. …

Threat intelligence, references, and detailed analysis are available after sign-in.