What is the CVSS score of CVE-2026-48837?

CVE-2026-48837 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Unlimited Elements For Elementor are affected by CVE-2026-48837?

The Unlimited Elements For Elementor WordPress plugin (versions ≤2.0.8) contains a blind SQL injection vulnerability accessible to authenticated low-privilege users, enabling direct database access…

How to fix or mitigate CVE-2026-48837?

24 hours: Inventory all WordPress installations using Unlimited Elements For Elementor; identify current plugin versions. 7 days: Disable and remove the plugin if not business-critical, OR if retention is required, restrict all plugin access to administrator accounts only and audit existing low-privilege user access. 30 days: Monitor Patchstack and Unlimited Elements project repositories for security patch release; develop contingency plan for plugin replacement if no patch materializes within 60 days.

Unlimited Elements For Elementor CVE-2026-48837

EUVD-2026-31759 HIGH

SQL Injection (CWE-89)

2026-05-25 Patchstack

GHSA-679r-jm2j-3cr6

SQLi Unlimited Elements For Elementor

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:22 vuln.today

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements For Elementor allows Blind SQL Injection.

This issue affects Unlimited Elements For Elementor: from n/a through 2.0.8.

AnalysisAI

Blind SQL injection in the Unlimited Elements For Elementor WordPress plugin (versions up to and including 2.0.8) allows authenticated low-privilege attackers to inject arbitrary SQL into backend database queries. The flaw was reported by Patchstack and carries a CVSS 3.1 score of 8.5 due to scope change and high confidentiality impact, though no public exploit identified at time of analysis and EPSS probability remains low at 0.03%. The scope change (S:C) indicates the injection crosses a trust boundary, amplifying impact beyond the vulnerable component.

Technical ContextAI

Unlimited Elements For Elementor is a popular WordPress plugin (CPE cpe:2.3:a:unlimited_elements:unlimited_elements_for_elementor) that extends the Elementor page builder with additional widgets, addons, and templates. The root cause is CWE-89 - Improper Neutralization of Special Elements used in an SQL Command - meaning user-controllable input is concatenated into SQL queries against the WordPress MySQL/MariaDB database without proper parameterization or escaping via $wpdb->prepare(). Because the attack is blind, the attacker does not see query results directly but must infer data through boolean conditions, timing delays, or out-of-band channels.

RemediationAI

No vendor-released patch identified at time of analysis from the provided data - administrators should monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/unlimited-elements-for-elementor/vulnerability/wordpress-unlimited-elements-for-elementor-free-widgets-addons-templates-plugin-2-0-8-sql-injection-vulnerability) and the WordPress plugin repository for an update beyond 2.0.8 and apply it as soon as published. Compensating controls in the interim include disabling open user registration in WordPress (Settings → General → 'Anyone can register') to remove the PR:L attacker, deactivating the plugin if its widgets are not in active production use (trade-off: any pages relying on its widgets will lose layout/functionality), enabling Patchstack vPatch or an equivalent WAF rule for this CVE to block the injection payload (trade-off: rule fidelity depends on Patchstack signature accuracy), and restricting access to wp-admin via IP allowlist or HTTP auth (trade-off: breaks legitimate low-privilege user workflows). Review database audit logs for anomalous SELECT/UNION patterns or unusually long query times consistent with time-based blind SQLi probing.