CVE-2026-2503
Time-Based SQL Injection in ElementCamp WordPress Plugin
Publication date: 2026-03-21
Last updated on: 2026-03-21
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| elementcamp | elementcamp_plugin | to 2.3.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The ElementCamp plugin for WordPress has a time-based SQL Injection vulnerability in the 'meta_query[compare]' parameter used in the 'tcg_select2_search_post' AJAX action. This vulnerability exists in all versions up to and including 2.3.6.
The issue arises because the user-supplied 'compare' value is used as an SQL operator in a query without proper validation against an allowlist of comparison operators. Although the value is passed through esc_sql(), this function does not prevent injection when the payload acts as an operator outside of quotes.
As a result, authenticated attackers with Author-level access or higher can append additional SQL queries to existing ones, potentially extracting sensitive information from the database.
How can this vulnerability impact me? :
This vulnerability allows authenticated users with Author-level access or above to perform time-based SQL Injection attacks, which can lead to unauthorized extraction of sensitive information from the database.
Because the attacker can append additional SQL queries, they might access confidential data that should otherwise be protected, potentially compromising the confidentiality of your system's data.
The vulnerability has a CVSS v3.1 base score of 6.5, indicating a medium severity with high impact on confidentiality but no impact on integrity or availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know