A new serious vulnerability has been discovered in the Ally plugin for WordPress, which is developed by Elementor and is widely used to improve the accessibility and usability of websites. The security issue could allow attackers to gain access to sensitive data without even having to log in to an account. Given that the plugin is used by more than 400,000 websites worldwide, the discovery of the vulnerability caused immediate concern in the cybersecurity community and administrators of websites based on the WordPress platform.
The CVE-2026-2413 vulnerability and its discovery
The security issue has been officially reported as CVE-2026-2413 and is classified as a high-risk vulnerability. It was discovered by security researcher Drew Webber, known in the community as mcdruid, who works as a security engineer at Acquia. Acquia is active in the enterprise-level Digital Experience Platform (DXP) space, providing tools that help large organizations manage their digital content and online services . This discovery confirms once again that even popular plugins can be a gateway for cyberattacks.
See also: Critical vulnerabilities in n8n allow remote code execution
What is SQL Injection and why it remains dangerous
SQL injection vulnerabilities are one of the oldest and most persistent security problems on the Internet. Although they have been known for more than 25 years, they continue to appear in modern applications . This particular category of vulnerability occurs when user-entered data is directly incorporated into an SQL database query without being properly checked or “cleaned”. In this case, an attacker can insert their own SQL commands and modify the way the query. operates This allows data to be read, modified, or even deleted from a website’s database, putting user information, credentials, and other critical data at risk.
How the vulnerability in the WordPress plugin Ally works
According to the technical analysis published by Wordfence security researchers , the vulnerability affects all versions of the Ally plugin up to version 4.0.3 . The problem is located in the way the plugin handles a user-supplied URL parameter. This parameter is passed to a critical system function without sufficient sanitization of the data before being incorporated into an SQL query. More specifically, the parameter is passed to the get_global_remediations() method , where it is added directly to an SQL JOIN command. Although the esc_url_raw() function is implemented to check the URL, it is not sufficient to prevent the introduction of special SQL characters, such as single quotes or parentheses. As a result, an attacker can add additional SQL commands to existing queries and exploit runtime-based blind SQL injection techniques to extract data from the database
See also: Vulnerability in MediaTek chips affects Android smartphones
When can the vulnerability be exploited?
Wordfence notes that exploiting the vulnerability is not possible in all cases. To carry out an attack, the Ally plugin must be connected to an active Elementor account and the Remediation feature must be enabled . However, given that many websites use this feature to improve accessibility , the number of potential targets remains significant.
Fixing the problem and low upgrade rates
The vulnerability was officially disclosed to Elementor on February 13, after Wordfence confirmed it. The company quickly moved to fix the issue with the release of version 4.1.0, which was published on February 23. For discovering the bug, the researcher received a monetary reward of $800 through a bug bounty program. However, data from WordPress.org shows that only about 36% of websites using Ally have installed the new version. This means that over 250,000 websites remain exposed to the CVE-2026-2413 vulnerability.
See also: CISA: Ivanti EPM and Cisco SD-WAN vulnerabilities in the KEV List
New security updates and recommendations for administrators
In addition to updating the Ally plugin, experts also recommend installing the latest version of the WordPress platform . The recently released WordPress 6.9.2 version fixes a total of ten different security vulnerabilities. These include errors cross-site scripting (XSS) , authorization bypass , and server-side request forgery (SSRF) . Experts emphasize that timely installation of updates remains one of the most effective ways to protect websites from modern cyber threats.
Source: www.bleepingcomputer.com
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
