Description

Editor SQL Injection in Sky Addons for Elementor <= 3.8.4 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-09-11T19:17:43.720Z",
  "pubdate": "2026-09-11T19:17:43.720Z",
  "executiveSummary": "The Sky Addons for Elementor plugin, in versions 3.8.4 and earlier, is susceptible to an unauthenticated SQL injection vulnerability.\nThis vulnerability stems from improper sanitization and neutralization of user-supplied input before it is incorporated into database queries.\nA remote, unauthenticated attacker can exploit this flaw to manipulate the application's database structure, execute arbitrary SQL commands, and potentially extract sensitive data, including user credentials and configuration details.\nThe risk implication is critical, as successful exploitation bypasses standard application security controls, leading to complete database compromise.\nAttackers do not require prior authentication to execute the payload, making this an accessible entry point for unauthorized data access and potential server-side compromise.",
  "technicalDetails": "The vulnerability resides within the Sky Addons for Elementor plugin's internal handling of AJAX actions and parameter processing. The root cause is the failure to adequately sanitize or parameterize input provided through specific user-controlled parameters before passing them to the database layer.\nIn versions 3.8.4 and below, the plugin's code includes functions that dynamically construct SQL queries based on unsanitized user inputs. By injecting malicious SQL syntax into these parameters, an attacker can alter the logic of the original query.\nThe attack flow begins when an unauthenticated user sends a crafted request containing a malicious payload designed to terminate the intended query and append unauthorized SQL commands via a UNION or boolean-based injection technique.\nBecause the plugin interacts directly with the WordPress database object (typically using the $wpdb class without proper use of the prepare() method), the malicious input is interpreted as executable code rather than literal data. This allows for the manipulation of the WHERE clause, enabling the attacker to bypass authentication filters or dump sensitive table contents.\nExploitation requires no elevated privileges, as the vulnerable endpoint is accessible to any visitor. Once the SQL injection is successfully executed, the attacker can leverage the database's permissions to read administrative tables, extract user hashes, or potentially modify configuration settings that could lead to further server-side exploitation, such as privilege escalation or the injection of persistent malicious content into the WordPress site.\nThe lack of input validation and the omission of prepared statements during query construction constitute the core security failure within the plugin's architectural implementation. The issue is persistent across all versions up to and including 3.8.4."
}