CVE-2026-2503 is a time-based SQL Injection vulnerability in the ElementCamp plugin for WordPress, affecting all versions up to 2.3.6. The issue exists in the 'meta_query[compare]' parameter of the 'tcg_select2_search_post' AJAX action, where user-supplied input is used directly as an SQL operator without validation against an allowlist. Although esc_sql() is applied, it does not mitigate injection of operators that do not contain quotes, enabling attackers with Author-level privileges or higher to append additional SQL queries and potentially extract sensitive data from the database.

An authenticated attacker with Author-level or higher privileges can exploit this vulnerability to perform time-based SQL Injection attacks, allowing extraction of sensitive information from the database. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure, as indicated by the CVSS vector (Confidentiality: High, Integrity: None, Availability: None). No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and monitor for suspicious activity related to the 'tcg_select2_search_post' AJAX action. Avoid exposing this AJAX endpoint unnecessarily. Follow vendor updates closely for a forthcoming patch or official mitigation.