CVE-2024-6166 is a SQL Injection vulnerability in the Unlimited Elements For Elementor plugin for WordPress. It arises from insufficient escaping and lack of proper preparation of the 'addons_order' parameter in SQL queries. Authenticated attackers with Contributor-level access and plugin setting edit permissions can exploit this to append malicious SQL commands, potentially extracting sensitive data from the database. The vulnerability affects all versions up to and including 1.5.112. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and privileges required at the contributor level.

Successful exploitation allows an authenticated user with Contributor-level access and plugin setting edit permissions to perform time-based SQL Injection attacks. This can lead to unauthorized disclosure of sensitive information from the database, as well as potential integrity and availability impacts due to the high CVSS impact metrics on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin setting edit permissions strictly to trusted administrators and avoid granting Contributor-level users such permissions. Monitor for updates from the vendor or security advisories for a patch or official mitigation.