CVE-2026-18561

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in the getWhereString() function; when the parameter is supplied as an array, element zero is used verbatim as the SQL comparison operator and concatenated into the WHERE clause without sanitization, while normalizeAjaxInputData() strips WordPress's magic_quotes protection from the value. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

• CWE-89

• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/framework/db.class.php#L216
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_actions.class.php#L87
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_addon.class.php#L304
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_addons.class.php#L1387
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/provider_functions.class.php#L611
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3661670%40unlimited-elements-for-elementor%2Ftrunk&old=3628543%40unlimited-elements-for-elementor%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/969d605d-e093-447c-abf7-0d56cb3ac569?source=cve

Published

Sep 11, 2026

Last Modified

Sep 11, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18549@fastify/multipart is a multipart form-data parser for Fasti…7.5
• CVE-2026-18550The Nokri - Job Board WordPress Theme for WordPress is vulne…9.8
• CVE-2026-18554IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote …7.5
• CVE-2026-18555The Better Messages – Chat Rooms, Group Chat, Private Messag…6.1
• CVE-2026-18556Authentication bypass using an alternate path or channel vul…7.4
• CVE-2026-1856The Appointment Booking Calendar plugin for WordPress is vul…6.4
• CVE-2026-18562The HUSKY – Products Filter Professional for WooCommerce plu…6.1
• CVE-2026-18567IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local a…4.7
• CVE-2026-18568XML::Sig versions from 0.29 before 0.72 for Perl allow signa…7.5
• CVE-2026-18569A flaw was found in the backchannel logout endpoint of the k…3.7
• CVE-2026-1857The Gutenberg Blocks with AI by Kadence WP plugin for WordPr…4.3
• CVE-2026-18570A flaw was found in the full-scope-disabled client-policy ex…5.4