SKT Addons for Elementor CVE-2026-66626

Requires an authenticated WordPress session with a high-privilege role (PR:H - typically Editor/Administrator level) that can access the Elementor editor functionality exposed by SKT Addons for Elementor version 4.0 or earlier; the plugin must be installed and active. No user interaction (UI:N) and no non-default configuration beyond having the plugin enabled are needed. The high-privilege requirement is the primary limiting factor: exploitation is not available to unauthenticated visitors or low-privilege subscribers, confining risk to insider misuse or a chained privilege compromise.

The vendor CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L, base 7.6) describes a network-reachable, low-complexity SQL injection that nonetheless requires high privileges (PR:H) - consistent with Patchstack's convention that an authenticated Editor/Admin-level WordPress account is needed to reach the vulnerable Elementor editor endpoint. This authentication gate is the single largest risk-reducer: an attacker must already hold a trusted, high-privilege role, which sharply limits the realistic threat population versus an unauthenticated SQLi. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied intelligence, so exploitation status is 'no public exploit identified at time of analysis' - there is no evidence of active or automated exploitation. The impact profile is also unusual for a SQLi: the vendor set C:H but I:N and only A:L, implying primarily unauthorized data read (and a scope change, S:C, reflecting access to the backing database beyond the plugin's own security authority) rather than data tampering. Net: this is a moderately-severe, authenticated data-disclosure issue in a niche plugin, not a high-urgency internet-wide threat. Note the metric tension - a genuine SQL injection normally permits at least some write/integrity impact, so the vendor's I:N is conservative and worth verifying against the Patchstack advisory.

An attacker who already holds a high-privilege WordPress account (e.g., a compromised or malicious Editor/Admin) submits crafted input to an Elementor editor endpoint provided by SKT Addons for Elementor <= 4.0, injecting SQL that the plugin passes unsanitized into a database query. This lets them read arbitrary database contents such as other users' data, password hashes, and secrets. No public exploit code is identified in the provided data, and the network vector with low complexity means exploitation is straightforward once the required privileged session is obtained.