Unlimited Elements for Elementor SQL Injection

If your WordPress site runs the Unlimited Elements for Elementor plugin at version 2.0.20 or older, update it to the latest release now, because a critical SQL injection flaw (CVE-2026-103355) has been published for it.

This post is for owners of WordPress sites built with Elementor, including people who never chose this plugin themselves (a freelancer or a template may have installed it). You'll learn what the bug is in plain English, how to check your version in two minutes, what to do if you can't update today, and how to look for signs of trouble.

What happened

On 2026-10-04, the National Vulnerability Database (NVD) published CVE-2026-103355. The NVD is the US government's public catalog of known software flaws. A CVE is just a numbered ID for one flaw, so everyone talks about the same bug.

The record covers the plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates), slug unlimited-elements-for-elementor. It describes a Blind SQL Injection weakness. It lists the affected range as "from n/a through 2.0.20", which means the record does not name a starting version. Treat every version up to and including 2.0.20 as affected.

The NVD rates it Critical, with a CVSS score of 9.3 out of 10. CVSS is a standard scoring system for how serious a flaw is. The NVD status shows as "Deferred", which means the NVD has not finished its own analysis of the entry. That is a paperwork state. It does not mean the flaw is minor.

The record points to a report in the Patchstack vulnerability database as its reference. Patchstack is a company that tracks WordPress plugin flaws.

What is a blind SQL injection?

Your WordPress site keeps almost everything in a database: posts, settings, user accounts, and password hashes (scrambled versions of passwords). The site talks to that database using a language called SQL.

SQL injection happens when a plugin builds a database request using text from a visitor without cleaning it properly. A visitor can then slip in their own SQL instructions. OWASP, the nonprofit security standards group, describes this as one of the classic web flaws.

Blind means the attacker can't see database results directly on the page. Instead they ask the database a long series of yes/no questions and read the answers from small differences, such as whether the page loads slowly or looks slightly different. It is slower for them, but it can still pull out real data.

The proper defense, per the WordPress developer docs, is to use prepared queries ($wpdb->prepare()), which keep visitor text separate from SQL instructions. That is a fix the plugin author makes in code. You can't patch it by hand.

What the score tells us

The NVD scored this as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. Here is what each part means in plain English:

In short, the scoring describes a flaw that can be tried from the internet, without an account, with a high impact on data privacy. That is why it lands in the critical band.

What the record does not say: it does not claim attacks are happening in the wild, and it does not publish how to exploit the bug. We won't guess either way. Updating is the right move regardless.

Who is affected

You are affected if all of these are true:

• The plugin Unlimited Elements for Elementor is installed on your WordPress site.
• It is version 2.0.20 or older.
• It is active, or at least present on the server. To be safe, treat installed-but-inactive plugins as something to remove or update, not ignore.

You are probably not affected by this specific CVE if you only use Elementor itself, or a different addon pack. Different plugins have different code. Check the plugin list instead of assuming.

Step 1: check your version

In the dashboard:

1. Log in to WordPress admin.
2. Go to Plugins > Installed Plugins.
3. Find Unlimited Elements for Elementor and read the version number under its name.

With WP-CLI (a command-line tool many hosts provide):

wp plugin get unlimited-elements-for-elementor --field=version

If you see 2.0.20 or lower, move to step 2. If the command says the plugin doesn't exist, it isn't installed.

Step 2: back up, then update

The NVD record does not list a specific fixed version. So the safe instruction is: update to the latest available release, then read the plugin's changelog (the version history, on the plugin's WordPress.org page under the Development tab (Changelog section)) to confirm the security fix is described. A release newer than 2.0.20 is outside the range the record lists as affected.

If the latest version offered is still 2.0.20 or lower, no fixed release is confirmed yet. Deactivate and delete the plugin (or replace its widgets) until the vendor publishes a version that the changelog says fixes this CVE.

1. Take a backup of your files and database. Your host's backup tool or a backup plugin both work.
2. In Plugins > Installed Plugins, click Update now under Unlimited Elements for Elementor. Or run:

wp plugin update unlimited-elements-for-elementor

1. Re-check the version number.
2. Open your key pages (home, contact form, checkout if you have one) and confirm they look right. Clear any caching plugin or CDN cache.

If you manage many sites, turn on auto-updates for this plugin under Plugins > Installed Plugins > Enable auto-updates. For a plugin that handles page layout, test on a staging copy first if you have one, but don't let testing delay a critical update for weeks.

If you can't update today

Sometimes an update breaks a page design, or the vendor release isn't available to you yet. Use this table to pick a stopgap.

A web application firewall (WAF) from your host or a security plugin may help block some attacks, but treat it as a bonus layer. It does not replace the update.

Step 3: look for signs of trouble

Blind SQL injection tends to be noisy, because it needs many requests. If your site was exposed before you patched, a quick check is worth the ten minutes.

• Look for unknown admins. Run wp user list --role=administrator and check every name and email. Note the username, email and creation date first (for example wp user list --role=administrator --fields=ID,user_login,user_email,user_registered), then remove the account.
• Scan your access logs (paths vary by host) for odd SQL words in requests:

grep -iE 'sleep|benchmark|union.+select' /var/log/nginx/access.log

Expect some harmless matches. A long run of near-identical requests from one address, hitting the same plugin URL, is the pattern to worry about. A clean log doesn't prove you're safe, since many hosts keep logs for only a short time.

• Watch for odd behavior: unexpected redirects, new plugins you didn't install, spam pages, or your host warning about unusual traffic.

Because the score rates data exposure as high, it is reasonable to be cautious if you saw anything strange. Reset admin passwords, and replace the WordPress security keys in wp-config.php using the generator at https://api.wordpress.org/secret-key/1.1/salt/ (this logs everyone out). If you suspect a break-in, follow our website hacked guide.

Why this keeps happening with plugins

WordPress itself is maintained by a large team. Many WordPress security problems are reported in third-party plugins rather than in WordPress core, because there are tens of thousands of plugins and quality varies. A page builder addon pack is a big piece of code that touches many parts of your site, so one mistake can matter a lot.

You can't remove that risk, but you can shrink it:

• Delete plugins you don't use.
• Keep everything updated, and enable auto-updates where practical.
• Subscribe to alerts so you hear about a flaw within days, not months.
• Get a human to look at your site every so often. Automated tools catch known version numbers; a person can notice what's odd about how your particular site is set up. See our comparison of manual vs automated penetration testing.

Want a quick read on your site's outside-facing state? Our free website security check needs no card and no login. For a wider look at exposure, see is my website hackable.

Key takeaways

• CVE-2026-103355 is a critical (CVSS 9.3) blind SQL injection in Unlimited Elements for Elementor, affecting versions up to and including 2.0.20.
• Check your version under Plugins > Installed Plugins, or with wp plugin get unlimited-elements-for-elementor --field=version.
• Back up, then update to the latest release and read the changelog, since the NVD record lists no specific fixed version. If the latest version is still 2.0.20 or lower, no fixed release is confirmed, so deactivate and delete the plugin until the changelog says this CVE is fixed.
• If you can't update, or an update breaks your layout and you can't fix it quickly, deactivate and delete the plugin rather than leaving a vulnerable copy on the server.
• After patching, check for unknown admin users and odd log entries, and reset passwords if anything looks wrong.

What to do next

Updating closes this one hole. It doesn't tell you what else is open. If you'd like a real person to go through your whole site and hand you a written list of problems with exact fixes, that is what the Circuit audit does, for a one-time $49. It is a focused audit for small sites, not an enterprise pentest or a compliance certificate. You can see the options on our pricing page.