CVE-2026-18561

Unlimited Elements For Elementor, a popular WordPress widget library plugin, contains an unauthenticated SQL injection flaw in the 'addontype' parameter reaching getWhereString(). Because normalizeAjaxInputData() strips WordPress's magic-quotes protection and the parameter is insufficiently escaped, an attacker supplying it as an array can have element zero used verbatim as the SQL comparison operator and concatenated into the WHERE clause, allowing additional SQL queries to be appended to existing ones. A remote, unauthenticated attacker can leverage this to extract sensitive information from the site's database (confidentiality impact only; no alteration or disruption is scored). Any WordPress site running the plugin in versions up to and including 2.0.16 is affected, and the flaw is reachable without credentials or user interaction. There is currently no evidence of in-the-wild exploitation, no public proof-of-concept, and the issue is not on the CISA KEV list.

What to do: Update Unlimited Elements For Elementor to the latest patched release (anything newer than 2.0.16) as soon as possible; verify the installed version in the WordPress plugins dashboard. Until patched, restrict or monitor unauthenticated AJAX/REST access to the plugin's endpoints, and after patching check site logs for unusual 'addontype' array parameters and audit the WordPress database for unauthorized changes or exposed sensitive data.