This vulnerability (CVE-2024-30496) in BdThemes Element Pack Elementor Addons is caused by improper neutralization of special elements used in SQL commands, classified as CWE-89 (SQL Injection). It affects versions up to 5.5.3 and allows an attacker with low privileges and no user interaction to potentially cause a partial denial of service and compromise confidentiality by injecting malicious SQL. The CVSS 3.1 score is 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. No patch or official fix is currently documented.

Successful exploitation could allow an attacker with low privileges to execute unauthorized SQL commands, potentially leading to partial denial of service and significant confidentiality breaches. The vulnerability does not impact integrity but may affect availability to a limited extent. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit privileges of accounts interacting with the plugin and monitor for unusual database activity. Avoid exposing the vulnerable plugin to untrusted users. Apply vendor patches promptly once available.