UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2023-0329

Elementor Website Builder – more than just a page builder: SQL Injection

Severity
High 7.2
Published
24 Apr 2023
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
3.12.2
Also known as
WPV-565068cf2e56
Sources
NVD, WPVulnerability

Description

The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statement, leading to a SQL injection exploitable by users with the Administrator role.

Affected software

SoftwareAffected versions
ElementorServers and applications · cpe:a:elementor:website_builder
  • Every version before 3.12.2
ElementorWordPress plugins · wp-plugin:elementor
  • Every version before 3.12.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-0329
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-0329
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/elementor/elementor-3121-authenticatedadministrator-sql-injection-via-replace-urls