Esta página ainda não foi traduzida para o seu idioma. Exibindo conteúdo em inglês enquanto trabalhamos nisso.
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2026-5486: SQL Injection in Unlimited Elements for Elementor
Plataforma
wordpress
Componente
unlimited-elements-for-elementor
Corrigido em
2.0.8
CVE-2026-5486 describes a SQL Injection vulnerability discovered in the Unlimited Elements for Elementor plugin for WordPress. This flaw allows attackers to inject malicious SQL code, potentially compromising sensitive data stored within the WordPress database. The vulnerability affects versions 1.0.0 through 2.0.7, and a patch is available in version 2.0.8.
Detecte esta CVE no seu projeto
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.
Impacto e Cenários de Ataquetraduzindo…
Successful exploitation of CVE-2026-5486 could allow an attacker to bypass authentication and gain unauthorized access to the WordPress database. This could lead to the exfiltration of sensitive user data, including usernames, passwords, email addresses, and potentially financial information if the site processes payments. An attacker could also modify or delete data, leading to website defacement or complete data loss. The vulnerability's impact is amplified by the widespread use of WordPress and Elementor, potentially affecting a large number of websites. The combination of insufficient sanitization and deprecated escaping functions makes this a particularly dangerous vulnerability.
Contexto de Exploraçãotraduzindo…
CVE-2026-5486 was published on 2026-05-14. Its severity is currently assessed as medium. No public exploits or proof-of-concept code have been publicly disclosed at the time of writing. The vulnerability is not currently listed on KEV or EPSS, indicating a low to medium probability of active exploitation. Monitor security advisories and threat intelligence feeds for any updates.
Inteligência de Ameaças
Status do Exploit
CISA SSVC
Vetor CVSS
O que significam essas métricas?
- Attack Vector
- Rede — explorável remotamente pela internet. Sem acesso físico ou local necessário.
- Attack Complexity
- Baixa — sem condições especiais. O atacante pode explorar de forma confiável.
- Privileges Required
- Baixo — qualquer conta de usuário válida é suficiente.
- User Interaction
- Nenhuma — ataque automático e silencioso. A vítima não faz nada.
- Scope
- Inalterado — impacto limitado ao componente vulnerável.
- Confidentiality
- Alto — perda total de confidencialidade. O atacante pode ler todos os dados.
- Integrity
- Nenhum — sem impacto na integridade.
- Availability
- Nenhum — sem impacto na disponibilidade.
Software Afetado
Classificação de Fraqueza (CWE)
Linha do tempo
- Reservado
- Publicada
- Modificada
Mitigação e Soluções Alternativastraduzindo…
The primary mitigation for CVE-2026-5486 is to immediately upgrade the Unlimited Elements for Elementor plugin to version 2.0.8 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious SQL injection attempts targeting the getcataddons AJAX action and the data[filter_search] parameter. Carefully review and sanitize all user inputs within the plugin's code to prevent future vulnerabilities. After upgrading, confirm the vulnerability is resolved by attempting a SQL injection payload via the affected parameter and verifying that it is properly sanitized.
Como corrigir
Atualize para a versão 2.0.8, ou uma versão corrigida mais recente
Perguntas frequentestraduzindo…
What is CVE-2026-5486 — SQL Injection in Unlimited Elements for Elementor?
CVE-2026-5486 is a SQL Injection vulnerability affecting the Unlimited Elements for Elementor WordPress plugin, allowing attackers to inject malicious SQL code and potentially access sensitive data.
Am I affected by CVE-2026-5486 in Unlimited Elements for Elementor?
You are affected if you are using Unlimited Elements for Elementor versions 1.0.0 through 2.0.7. Check your plugin version and upgrade immediately if vulnerable.
How do I fix CVE-2026-5486 in Unlimited Elements for Elementor?
Upgrade the Unlimited Elements for Elementor plugin to version 2.0.8 or later. If immediate upgrade is not possible, implement a WAF rule to block suspicious requests.
Is CVE-2026-5486 being actively exploited?
Currently, there are no publicly known active exploits or campaigns targeting CVE-2026-5486, but it's crucial to apply the patch promptly to mitigate potential future attacks.
Where can I find the official Unlimited Elements for Elementor advisory for CVE-2026-5486?
Refer to the official Unlimited Elements for Elementor plugin website or the WordPress plugin repository for the latest security advisory and update information.
Seu projeto está afetado?
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.
Detecte esta CVE no seu projeto
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.
Escaneie seu projeto WordPress agora — sem conta
Faça upload de qualquer manifesto (composer.lock, package-lock.json, lista de plugins WordPress…) ou cole sua lista de componentes. Receba um relatório de vulnerabilidades instantaneamente. Fazer upload de um arquivo é só o começo: com uma conta, você obtém monitoramento contínuo, alertas por Slack/email, relatórios multiprojeto e white-label.
Arraste e solte seu arquivo de dependências
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...