CVE-2026-40745
Blind SQL Injection in bdthemes Element Pack Elementor Addons
Publication date: 2026-04-15
Last updated on: 2026-04-15
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bdthemes | element_pack_elementor_addons | to 8.4.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability affects WordPress sites using the Element Pack Elementor Addons Plugin versions up to and including 8.4.2. Detection involves identifying if the vulnerable plugin version is installed.
To detect the vulnerability on your system, you can check the installed plugin version via WordPress admin or by inspecting the plugin files.
- Use WP-CLI to check the plugin version: wp plugin list --status=active
- Look for 'bdthemes-element-pack-lite' in the list and verify its version.
- If the version is 8.4.2 or lower, the plugin is vulnerable.
Network detection of exploitation attempts may require monitoring for unusual SQL queries or suspicious activity from users with editor or developer privileges, but no specific commands or signatures are provided in the available resources.
How can this vulnerability impact me? :
This vulnerability can allow attackers with certain privileges to interact directly with your website's database, potentially leading to unauthorized data access or theft. It poses a moderate risk with a CVSS score of 7.6. Although considered low priority due to limited impact and lower likelihood of exploitation, it can be used in mass-exploit campaigns targeting many websites indiscriminately.
Can you explain this vulnerability to me?
CVE-2026-40745 is an SQL Injection vulnerability found in the WordPress Element Pack Elementor Addons Plugin versions up to and including 8.4.2. This vulnerability allows a malicious user with at least editor or developer privileges to execute unauthorized SQL commands on the website's database. This can lead to unauthorized access or theft of data. The vulnerability falls under the OWASP Top 10 category A3: Injection.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the SQL Injection vulnerability in the bdthemes Element Pack Elementor Addons plugin, users should update the plugin to version 8.5.0 or later, where the issue has been patched.
Patchstack also offers automated updates for vulnerable plugins to facilitate rapid mitigation.
Since the vulnerability allows malicious actors with editor or developer privileges to interact with the database, limiting such privileges and monitoring user roles can also help reduce risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The SQL Injection vulnerability in the bdthemes Element Pack Elementor Addons plugin allows unauthorized access to the website's database, which could lead to unauthorized data access or theft.
Such unauthorized data access or theft can potentially result in non-compliance with data protection regulations like GDPR and HIPAA, which require the protection of sensitive personal and health information.
Therefore, if exploited, this vulnerability could compromise the confidentiality of protected data, leading to violations of these standards and regulations.