CVE-2026-5486: SQL Injection in Unlimited Elements for Elementor
Platform
wordpress
Component
unlimited-elements-for-elementor
Fixed in
2.0.8
CVE-2026-5486 describes a SQL Injection vulnerability discovered in the Unlimited Elements for Elementor plugin for WordPress. This flaw allows attackers to inject malicious SQL code, potentially compromising sensitive data stored within the WordPress database. The vulnerability affects versions 1.0.0 through 2.0.7, and a patch is available in version 2.0.8.
Detect this CVE in your project
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Impact and Attack Scenarios
Successful exploitation of CVE-2026-5486 could allow an attacker to bypass authentication and gain unauthorized access to the WordPress database. This could lead to the exfiltration of sensitive user data, including usernames, passwords, email addresses, and potentially financial information if the site processes payments. An attacker could also modify or delete data, leading to website defacement or complete data loss. The vulnerability's impact is amplified by the widespread use of WordPress and Elementor, potentially affecting a large number of websites. The combination of insufficient sanitization and deprecated escaping functions makes this a particularly dangerous vulnerability.
Exploitation Context
CVE-2026-5486 was published on 2026-05-14. Its severity is currently assessed as medium. No public exploits or proof-of-concept code have been publicly disclosed at the time of writing. The vulnerability is not currently listed on KEV or EPSS, indicating a low to medium probability of active exploitation. Monitor security advisories and threat intelligence feeds for any updates.
Threat Intelligence
Exploit Status
CISA SSVC
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- Low — any valid user account is sufficient. Basic authenticated access required.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- None — no integrity impact. Attacker cannot modify data.
- Availability
- None — no availability impact. Service remains fully operational.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
- Modified
Mitigation and Workarounds
The primary mitigation for CVE-2026-5486 is to immediately upgrade the Unlimited Elements for Elementor plugin to version 2.0.8 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious SQL injection attempts targeting the getcataddons AJAX action and the data[filter_search] parameter. Carefully review and sanitize all user inputs within the plugin's code to prevent future vulnerabilities. After upgrading, confirm the vulnerability is resolved by attempting a SQL injection payload via the affected parameter and verifying that it is properly sanitized.
How to fix
Update to version 2.0.8, or a newer patched version
Frequently asked questions
What is CVE-2026-5486 — SQL Injection in Unlimited Elements for Elementor?
CVE-2026-5486 is a SQL Injection vulnerability affecting the Unlimited Elements for Elementor WordPress plugin, allowing attackers to inject malicious SQL code and potentially access sensitive data.
Am I affected by CVE-2026-5486 in Unlimited Elements for Elementor?
You are affected if you are using Unlimited Elements for Elementor versions 1.0.0 through 2.0.7. Check your plugin version and upgrade immediately if vulnerable.
How do I fix CVE-2026-5486 in Unlimited Elements for Elementor?
Upgrade the Unlimited Elements for Elementor plugin to version 2.0.8 or later. If immediate upgrade is not possible, implement a WAF rule to block suspicious requests.
Is CVE-2026-5486 being actively exploited?
Currently, there are no publicly known active exploits or campaigns targeting CVE-2026-5486, but it's crucial to apply the patch promptly to mitigate potential future attacks.
Where can I find the official Unlimited Elements for Elementor advisory for CVE-2026-5486?
Refer to the official Unlimited Elements for Elementor plugin website or the WordPress plugin repository for the latest security advisory and update information.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Detect this CVE in your project
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Scan your WordPress project now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...