CVE-2024-3055: 
WordPress vulnerability analysis and mitigation

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin contains a time-based SQL Injection vulnerability (CVE-2024-3055) in versions up to and including 1.5.102. The vulnerability exists due to insufficient escaping of the 'id' parameter and lack of proper SQL query preparation (NVD).

The vulnerability is classified as SQL Injection (CWE-89) with a CVSS v3.1 base score of 8.8 (HIGH) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The issue stems from insufficient escaping on user-supplied parameters and inadequate preparation of SQL queries, allowing authenticated users with contributor-level access or higher to append additional SQL queries to existing ones (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor access or higher to inject additional SQL queries into existing database queries. This can be used to extract sensitive information from the database, potentially compromising the security and integrity of the WordPress installation (NVD).

The vulnerability requires authentication with contributor-level access or higher to exploit. The attack complexity is considered low, requiring no user interaction to execute (NVD).

Users should update to a version newer than 1.5.102 of the Unlimited Elements For Elementor plugin to address this vulnerability (NVD).