CVE-2024-6166

The Unlimited Elements For Elementor plugin contains a security flaw in its handling of user input for the 'addons_order' parameter, which allows attackers with Contributor-level access and above to inject malicious SQL code into database queries. This vulnerability affects all versions up to 1.5.112, where insufficient protection against SQL injection enables unauthorized access to sensitive information. By exploiting this weakness, an attacker can extract confidential data from the WordPress database.

Based on public CVE data (MITRE/NVD).