External risk intelligence

Unlimited Elements for Elementor Blind SQL Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-103355

The vulnerability exists in a WordPress plugin used to render web page elements. As these plugins are specifically designed to be integrated into public-facing websites to generate content for internet users, the attack surface is commonly exposed and reachable over the public internet in standard deployment patterns.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Unlimited Elements for Elementor plugin, which can allow unauthorized access to information by exploiting how the software handles specific commands. This type of weakness, known as SQL injection, could potentially expose sensitive data if the plugin is used in your environment.

Plugin flaw allows unauthorized data access.
Confirms the need to verify plugin usage.
Assess relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted requests to a website using the affected plugin. The plugin fails to properly handle these requests, allowing the attacker to inject malicious SQL commands. This can lead to the leakage of sensitive information from the site's database.

No authentication or privileges required.
Malicious SQL commands injected via requests.
Sensitive data exposure from database.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to inject malicious SQL commands into the application when supported. This could potentially lead to unauthorized access to or manipulation of backend database information.

Sensitive database information could be exposed.
Attackers could send malicious SQL commands.
Unauthorized database access or modification may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

Security teams and application owners for websites using the Unlimited Elements for Elementor plugin should prioritize identifying all instances of the affected plugin, confirming exposure and business criticality, and coordinating remediation efforts. The initial step involves cataloging where this plugin is deployed to understand the scope and risk, followed by engaging the appropriate teams for planning and execution of fixes or mitigating controls.

Plugin owners, security, and infrastructure teams.
Verify plugin exposure and business criticality.
Plan and coordinate remediation efforts.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Unlimited Elements for Elementor plugin?

This software is a WordPress extension that provides a library of widgets, templates, and addons for the Elementor page builder. Designers and site administrators use it to add custom functionality and visual components to their WordPress sites without needing to write code from scratch. It is widely used to enhance the appearance and interactive features of web pages.

What does SQL injection mean for CVE-2026-103355?

The weakness, classified as CWE-89, happens when a plugin does not safely clean or filter the inputs it receives. Because of this failure, an attacker can insert their own database commands into the plugin's logic. In the context of this CVE, it specifically enables 'Blind SQL Injection,' meaning an attacker might retrieve sensitive data from the database by observing how the website reacts to different injected queries.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending specially crafted web requests to a site using the plugin. Because the vulnerability exists in the plugin's processing of these inputs, no special user privileges or prior authentication are needed to initiate the attack. Simply interacting with the public-facing components of the plugin is sufficient to potentially inject the malicious commands.

Is my website at risk from this CVE?

Halo Surface Signal indicates that because this plugin is designed to render elements on public-facing web pages, the attack surface is typically reachable over the internet. If your WordPress site uses this plugin and is accessible to the public, it is likely that an attacker could reach the vulnerable code. You should check your site's plugin inventory to confirm if you are using affected versions.

What should I do if I use this plugin?

Begin by creating a comprehensive list of all your websites where this plugin is currently installed. Once you have identified these instances, determine if they are internet-facing and assess the sensitivity of the data managed by those sites. Prioritize these deployments for updates or security controls while you coordinate with your technical teams to plan for the appropriate software patches.

References

patchstack.com/database/wordpress/plugin/unlimited-elements-for-elem…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.