EUVD-2026-14163
GHSA-95c6-28c3-2pjc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The ElementCamp plugin for WordPress is vulnerable to time-based SQL Injection via the 'meta_query[compare]' parameter in the 'tcg_select2_search_post' AJAX action in all versions up to, and including, 2.3.6. This is due to the user-supplied compare value being placed as an SQL operator in the query without validation against an allowlist of comparison operators. The value is passed through esc_sql(), but since the payload operates as an operator (not inside quotes), esc_sql() has no effect on payloads that don't contain quote characters. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
The ElementCamp plugin for WordPress contains a time-based SQL injection vulnerability in the 'tcg_select2_search_post' AJAX action through improper validation of the 'meta_query[compare]' parameter. Authenticated attackers with Author-level privileges or higher can inject arbitrary SQL operators to extract sensitive database information, as the vulnerable code places user-supplied comparison operators directly into SQL queries without allowlist validation, rendering esc_sql() ineffective for operator-level payloads. The CVSS score of 6.5 reflects moderate severity with high confidentiality impact but no integrity or availability impact, limited to authenticated users with elevated privileges.
Technical ContextAI
The vulnerability exists in the ElementCamp plugin (CPE: cpe:2.3:a:wpdive:elementcamp:*:*:*:*:*:*:*:*) specifically within the tcg-select2.php file's AJAX handler for the 'tcg_select2_search_post' action. The root cause is classified as CWE-89 (SQL Injection) and stems from unsafe handling of SQL comparison operators in meta_query parameters. The vulnerable code accepts user-supplied compare values that are passed through esc_sql(), which only escapes string literals and quote characters; since SQL operators exist outside of quoted contexts, the function provides no protection against operator-level injection. The WordPress meta_query API is intended to accept only predefined comparison operators (=, !=, <, >, etc.), but this implementation fails to enforce such a whitelist, allowing attackers to append additional SQL conditions or subqueries that execute within the database context of the WordPress installation.
RemediationAI
Immediately upgrade the ElementCamp plugin to a version newer than 2.3.6 where the compare parameter validation has been corrected to use an allowlist of permitted SQL operators. Visit the WordPress plugin repository or WPDive's official channels to obtain the patched version and apply it through the WordPress admin dashboard. Until patching is possible, restrict Author-level and above WordPress user accounts to trusted administrators only, and disable the 'tcg_select2_search_post' AJAX action if it is not actively used by disabling the plugin if possible. Additionally, implement WordPress security hardening practices such as enforcing strong password policies, enabling two-factor authentication, and monitoring database query logs for anomalous time-based injection patterns. For defense-in-depth, consider using a Web Application Firewall (WAF) rule to detect and block requests containing SQL injection patterns in the 'meta_query[compare]' parameter. Refer to the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/cfb09dcd-f8ec-4b0a-ae77-4b4b7b54c93b for detailed patch availability and release information.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today