What is the CVSS score of CVE-2026-5486?

CVE-2026-5486 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Unlimited Elements CVE-2026-5486

EUVD-2026-30214 MEDIUM

SQL Injection (CWE-89)

2026-05-14 Wordfence

GHSA-7q2p-8rmm-c8pg

SQLi WordPress Unlimited Elements For Elementor Elementor

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:52 vuln.today

CVE Published

May 14, 2026 - 02:26 nvd

MEDIUM 6.5

DescriptionCVE.org

The Unlimited Elements for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'data[filter_search]' parameter in the get_cat_addons AJAX action in versions up to and including 2.0.7. This is due to insufficient input sanitization and the use of deprecated escaping functions combined with direct string concatenation in SQL query construction. The vulnerability is exacerbated because the normalizeAjaxInputData() function calls stripslashes() on all user input, removing the protection provided by WordPress's wp_magic_quotes() function. Subsequently, the filter_search parameter is escaped using the deprecated wpdb->_escape() function and then directly concatenated into a LIKE clause without using prepared statements. This makes it possible for authenticated attackers, with Contributor-level access and above (who can obtain a valid nonce through the Elementor editor), to inject arbitrary SQL commands and extract sensitive information from the database.

AnalysisAI

SQL Injection in the Unlimited Elements for Elementor WordPress plugin (versions up to and including 2.0.7) allows authenticated attackers holding at least Contributor-level access to extract sensitive database contents by injecting arbitrary SQL into the 'data[filter_search]' parameter of the get_cat_addons AJAX action. The vulnerability is the product of two chained weaknesses: the plugin's normalizeAjaxInputData() function actively undoes WordPress's built-in magic-quote protection via stripslashes(), and the deprecated wpdb->_escape() method then fails to safely handle the exposed input before it is concatenated directly into a LIKE clause. Reported by Wordfence and tracked as EUVD-2026-30214, no public exploit code has been identified at time of analysis and CISA KEV does not list this CVE, though the confidentiality impact is rated High, enabling full database read access for a successful attacker.

Technical ContextAI

The affected product is the Unlimited Elements for Elementor WordPress plugin by unitecms (CPE: cpe:2.3:a:unitecms:unlimited_elements_for_elementor:*:*:*:*:*:*:*:*), versions 0 through 2.0.7. The root cause class is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). WordPress core protects against SQL injection at the superglobal level through wp_magic_quotes(), which automatically escapes single quotes in $_GET, $_POST, and $_COOKIE before plugin code executes. The plugin's normalizeAjaxInputData() function (unitecreator_actions.class.php, line 132) explicitly calls PHP's stripslashes() on all incoming AJAX input, deliberately stripping these escape sequences and nullifying WordPress's first-layer defense. The filter_search value is subsequently passed through wpdb->_escape() - a deprecated internal method that WordPress documentation explicitly warns against using in favor of $wpdb->prepare() or parameterized queries - and is then concatenated as a raw string into a SQL LIKE clause in provider_db.class.php (lines 82-84). This combination means user-controlled data reaches the database query engine unparameterized, enabling classic SQL injection through LIKE-clause payload crafting. The vulnerable AJAX endpoint get_cat_addons is protected by nonce verification, but that nonce is accessible to any user with Elementor editor access, as corroborated by the Wordfence advisory.

RemediationAI

The primary remediation is to update the Unlimited Elements for Elementor plugin to the latest available version beyond 2.0.7. A fix commit is confirmed to exist in the WordPress plugin SVN repository (changeset: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3513863%40unlimited-elements-for-elementor&new=3513863%40unlimited-elements-for-elementor), indicating the maintainer has pushed a patch; however, the exact patched release version number is not confirmed in the available data and should be verified against the WordPress plugin repository before deployment. Until patching is complete, the most effective compensating control is to audit and minimize Contributor-level role assignments, since exploitation is gated on that privilege level - removing untrusted Contributor accounts directly eliminates the threat surface. Deploying a WAF rule to inspect and block requests to wp-admin/admin-ajax.php containing the action=get_cat_addons parameter alongside SQL metacharacters in data[filter_search] can intercept exploitation attempts, though overly aggressive pattern matching may produce false positives on legitimate addon search queries. Consulting the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/b495914d-d8f2-4592-8461-1ae1056a0855 for the confirmed patched version is recommended before applying the update.