This vulnerability involves improper neutralization of special elements in SQL commands within Unlimited Elements For Elementor (Free Widgets, Addons, Templates), enabling blind SQL injection attacks. The affected versions include all releases prior to 2.0.21. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact.

An attacker with low privileges can exploit this vulnerability remotely to perform blind SQL injection, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). Integrity is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is available, consider restricting access to the affected plugin and monitoring for suspicious activity related to SQL injection attempts.