CVE-2026-18561 unitecms CVE debrief

Who should care

Defenders responsible for WordPress installations using the Unlimited Elements For Elementor plugin, especially versions up to and including 2.0.16, should assess the potential for SQL injection attacks and prioritize verifying exposure and updating the plugin.

Why it matters

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection, allowing unauthenticated attackers to append additional SQL queries into existing queries, potentially leading to sensitive information disclosure.

• Verify exposure of WordPress installations to potential SQL injection attacks
• Assess the potential for SQL injection attacks on versions up to and including 2.0.16
• Prioritize updating the plugin to a version that addresses the vulnerability

Technical summary

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in the getWhereString() function; when the parameter is supplied as an array, element zero is used verbatim as the SQL comparison operator and concatenated into the WHERE clause without sanitization, while normalizeAjaxInputData() strips WordPress's magic_quotes protection from the value.

Defensive priority

Defenders should prioritize verifying exposure of WordPress installations using the Unlimited Elements For Elementor plugin, especially versions up to and including 2.0.16, and assess the potential for SQL injection attacks.

Recommended defensive actions

• Verify exposure of WordPress installations using the Unlimited Elements For Elementor plugin, especially versions up to and including 2.0.16
• Assess the potential for SQL injection attacks
• Review and update the plugin to a version that addresses the vulnerability
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references to source code. The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in the getWhereString() function. The vulnerability allows unauthenticated attackers to append additional SQL

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.