Impact Analysis

This vulnerability can allow attackers with certain privileges to interact directly with your website's database, potentially leading to unauthorized data access or theft. It poses a moderate risk with a CVSS score of 7.6. Although considered low priority due to limited impact and lower likelihood of exploitation, it can be used in mass-exploit campaigns targeting many websites indiscriminately.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-40745 is an SQL Injection vulnerability found in the WordPress Element Pack Elementor Addons Plugin versions up to and including 8.4.2. This vulnerability allows a malicious user with at least editor or developer privileges to execute unauthorized SQL commands on the website's database. This can lead to unauthorized access or theft of data. The vulnerability falls under the OWASP Top 10 category A3: Injection.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the SQL Injection vulnerability in the bdthemes Element Pack Elementor Addons plugin, users should update the plugin to version 8.5.0 or later, where the issue has been patched.

Patchstack also offers automated updates for vulnerable plugins to facilitate rapid mitigation.

Since the vulnerability allows malicious actors with editor or developer privileges to interact with the database, limiting such privileges and monitoring user roles can also help reduce risk.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects WordPress sites using the Element Pack Elementor Addons Plugin versions up to and including 8.4.2. Detection involves identifying if the vulnerable plugin version is installed.

To detect the vulnerability on your system, you can check the installed plugin version via WordPress admin or by inspecting the plugin files.

• Use WP-CLI to check the plugin version: wp plugin list --status=active
• Look for 'bdthemes-element-pack-lite' in the list and verify its version.
• If the version is 8.4.2 or lower, the plugin is vulnerable.

Network detection of exploitation attempts may require monitoring for unusual SQL queries or suspicious activity from users with editor or developer privileges, but no specific commands or signatures are provided in the available resources.

Useful 0 Not Useful 0

Compliance Impact

The SQL Injection vulnerability in the bdthemes Element Pack Elementor Addons plugin allows unauthorized access to the website's database, which could lead to unauthorized data access or theft.

Such unauthorized data access or theft can potentially result in non-compliance with data protection regulations like GDPR and HIPAA, which require the protection of sensitive personal and health information.

Therefore, if exploited, this vulnerability could compromise the confidentiality of protected data, leading to violations of these standards and regulations.

Useful 0 Not Useful 0