CVE-2026-5486 is an SQL Injection vulnerability in the Unlimited Elements for Elementor WordPress plugin affecting versions up to 2.0.7. The issue is in the get_cat_addons AJAX action where the 'data[filter_search]' parameter is not properly sanitized. The plugin uses stripslashes() on all user input, negating WordPress's wp_magic_quotes() protections, and then escapes input with the deprecated wpdb->_escape() function before directly concatenating it into a SQL LIKE clause without prepared statements. This allows authenticated users with Contributor-level privileges or higher, who can obtain a valid nonce via the Elementor editor, to inject arbitrary SQL commands and potentially extract sensitive data from the database. The CVSS 3.1 score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, and limited privileges required.

An attacker with Contributor-level or higher access can exploit this vulnerability to perform SQL Injection attacks, enabling them to extract sensitive information from the WordPress database. The vulnerability does not allow privilege escalation or denial of service but compromises data confidentiality. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access and higher to trusted users only. Monitor for plugin updates from unitecms and apply any official patches promptly once available. Avoid using vulnerable plugin versions in sensitive environments.