Unlimited Elements For Elementor: Blind SQL injection

Summary

The WordPress plugin Unlimited Elements For Elementor up to and including version 2.0.20 contains a blind SQL injection vulnerability. An attacker can use it to read, modify or delete data in the website database, including user accounts and private data. Sources disagree on the required privilege: the CNA vector assumes no login is needed, while Patchstack lists Developer.

Affected

• Unlimited Elements For Elementor (Free Widgets, Addons, Templates), WordPress plugin, versions from n/a through 2.0.20
• Versions not listed are not affected according to the CNA data

Fixed in

• Version 2.0.21 according to Patchstack and VulDB
• Vendor confirmation not found yet; check the WordPress.org changelog

Workaround

• No vendor workaround found.
• Deactivate the plugin until it is updated (own suggestion, not from a source).
• Patchstack states it has issued a mitigation rule that blocks attacks until the plugin is updated.

Exploitation

• No evidence of exploitation in the wild found.
• Not listed in the CISA KEV catalog; CISA SSVC: exploitation none, automatable yes.
• VulDB status: not defined.
• Patchstack rates it High priority and expects exploitation.
• No public proof of concept found.

Our recommendation

• Inventory WordPress sites with this plugin and record their versions.
• Update to version 2.0.21 or later; if that is not possible, deactivate the plugin.
• If a vulnerable version was internet-facing, review database users, admin accounts and logs.
• Monitor the NVD and vendor for confirmation of the fixed version and the required privilege level.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  Hassham1/CVE-2026-103355-unlimited-elements-sqli-poc

Research sources

• Patchstack advisory patchstack.com
• VulDB CVE entry vuldb.com
• VulDB vulnerability 413414 vuldb.com
• Strix CVE entry www.strix.ai
• WordPress.org plugin page wordpress.org
• WPScan sibling vulnerability CVE-2026-85568 wpscan.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:32.