WordPress Download Manager Addons for Elementor plugin <= 1.3.0 - SQL Injection vulnerability

The SQL Injection vulnerability in Download Manager Addons for Elementor poses a significant risk to WordPress websites utilizing the plugin. An attacker could exploit this flaw to bypass authentication mechanisms and directly query the database. This could lead to the exfiltration of sensitive user data, including usernames, passwords, email addresses, and potentially even financial information if the plugin interacts with e-commerce functionalities. The blind nature of the injection means the attacker may need to perform numerous queries to extract data, but the potential impact remains severe. Successful exploitation could also allow an attacker to modify or delete data within the database, leading to website defacement or complete data loss. This vulnerability shares characteristics with other SQL injection attacks, where attackers leverage database queries to gain unauthorized access.

Websites utilizing Download Manager Addons for Elementor, particularly those with sensitive user data or financial transactions, are at significant risk. Shared hosting environments where multiple WordPress sites share the same database are especially vulnerable, as a compromise of one site could potentially lead to the compromise of others.

• wordpress / composer / npm:

grep -r "wpdm_download_id = '" /var/www/html/wp-content/plugins/download-manager-addons-for-elementor/includes/

• generic web:

curl -I https://your-wordpress-site.com/wp-admin/admin-ajax.php?action=wpdm_get_download_link&file_id=1 | grep SQL

1. 2026-02-20Disclosure

   disclosure

1. Reserviert2026-01-28
2. Veröffentlicht2026-02-20
3. Geändert2026-04-28
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-24956 is to immediately upgrade Download Manager Addons for Elementor to version 2.0.0 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin to reduce the attack surface. Web Application Firewalls (WAFs) configured with rules to detect and block SQL injection attempts can provide an additional layer of defense. Reviewing and hardening database user permissions, limiting access to only necessary data, can also reduce the potential impact of a successful exploit. Monitor WordPress logs for suspicious database queries that might indicate an ongoing attack.

Aktive Installationen

7KNische

Plugin-Bewertung