CVE-2026-24956: SQL Injection in Download Manager Addons for Elementor

The SQL Injection vulnerability in Download Manager Addons for Elementor allows an attacker to bypass security measures and directly interact with the underlying database. Because it's a blind SQL injection, the attacker doesn't receive direct output from the queries, but can infer information through timing attacks or other techniques. Successful exploitation could result in the extraction of sensitive user data, including usernames, passwords, email addresses, and potentially even file download history. Depending on the database schema, an attacker might also be able to modify or delete data, leading to data corruption or denial of service. The impact is particularly severe if the database contains sensitive information related to user accounts or financial transactions.

1. Reserved2026-01-28
2. Published2026-02-20
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-24956 is to immediately upgrade Download Manager Addons for Elementor to version 2.0.0 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. Web Application Firewalls (WAFs) configured with rules to detect and block SQL injection attempts can provide an additional layer of protection. Specifically, look for rules targeting SQL injection patterns in the plugin's input parameters. Regularly review and audit database access logs for suspicious activity, paying close attention to queries originating from the plugin. After upgrading, confirm the fix by attempting a SQL injection attack on the vulnerable endpoint and verifying that it is blocked.

Active installs

7KNiche

Plugin rating