CVE-2026-2503
Gravedad CVSS v3.1:
MEDIA
Tipo:
CWE-89
Neutralización incorrecta de elementos especiales usados en un comando SQL (Inyección SQL)
Fecha de publicación:
21/03/2026
Última modificación:
21/03/2026
Descripción
*** Pendiente de traducción *** The ElementCamp plugin for WordPress is vulnerable to time-based SQL Injection via the 'meta_query[compare]' parameter in the 'tcg_select2_search_post' AJAX action in all versions up to, and including, 2.3.6. This is due to the user-supplied compare value being placed as an SQL operator in the query without validation against an allowlist of comparison operators. The value is passed through esc_sql(), but since the payload operates as an operator (not inside quotes), esc_sql() has no effect on payloads that don't contain quote characters. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Impacto
Puntuación base 3.x
6.50
Gravedad 3.x
MEDIA
Referencias a soluciones, herramientas e información
- https://plugins.trac.wordpress.org/browser/element-camp/tags/2.3.6/elementor/extender/tcg-select2.php#L65
- https://plugins.trac.wordpress.org/browser/element-camp/tags/2.3.6/elementor/extender/tcg-select2.php#L83
- https://plugins.trac.wordpress.org/browser/element-camp/trunk/elementor/extender/tcg-select2.php#L65
- https://plugins.trac.wordpress.org/browser/element-camp/trunk/elementor/extender/tcg-select2.php#L83
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cfb09dcd-f8ec-4b0a-ae77-4b4b7b54c93b?source=cve