CVE-2026-5486

The Unlimited Elements for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'data[filter_search]' parameter in the get_cat_addons AJAX action in versions up to and including 2.0.7. This is due to insufficient input sanitization and the use of deprecated escaping functions combined with direct string concatenation in SQL query construction. The vulnerability is exacerbated because the normalizeAjaxInputData() function calls stripslashes() on all user input, removing the protection provided by WordPress's wp_magic_quotes() function. Subsequently, the filter_search parameter is escaped using the deprecated wpdb->_escape() function and then directly concatenated into a LIKE clause without using prepared statements. This makes it possible for authenticated attackers, with Contributor-level access and above (who can obtain a valid nonce through the Elementor editor), to inject arbitrary SQL commands and extract sensitive information from the database.

• CWE-89

• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/tags/2.0.6/inc_php/unitecreator_actions.class.php#L132
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/tags/2.0.6/inc_php/unitecreator_addons.class.php#L229
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/tags/2.0.6/provider/provider_functions.class.php#L482
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_actions.class.php#L132
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_addons.class.php#L188
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_addons.class.php#L229
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/provider_db.class.php#L82-L84
• https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/provider_functions.class.php#L482
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3513863%40unlimited-elements-for-elementor&new=3513863%40unlimited-elements-for-elementor&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b495914d-d8f2-4592-8461-1ae1056a0855?source=cve

Published

May 14, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54845Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versio…8.1
• CVE-2026-54846Unauthenticated Broken Access Control in Syncee Premium Drop…7.5
• CVE-2026-54847Unauthenticated Broken Access Control in Stylish Cost Calcul…7.5
• CVE-2026-54848Insertion of Sensitive Information Into Sent Data vulnerabil…8.3
• CVE-2026-54849Unauthenticated SQL Injection in Premmerce Wishlist for WooC…9.3
• CVE-2026-5485OS command injection in the browser-based authentication com…7.8
• CVE-2026-5487DriveLock Directory Traversal Information Disclosure Vulnera…7.5
• CVE-2026-54876Issue summary: A malicious TLS server can cause a memory lea…7.5
• CVE-2026-5488The ExactMetrics – Google Analytics Dashboard for WordPress …5.3
• CVE-2026-54885Server-Side Request Forgery vulnerability in malach-it Borut…6.9
• CVE-2026-54886Loop with Unreachable Exit Condition ('Infinite Loop') vulne…4.3
• CVE-2026-54887Use of Default Cryptographic Key vulnerability in Erlang/OTP…4.8