CVE-2026-2503
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedThe ElementCamp plugin for WordPress is vulnerable to time-based SQL Injection via the 'meta_query[compare]' parameter in the 'tcg_select2_search_post' AJAX action in all versions up to, and including, 2.3.6. This is due to the user-supplied compare value being placed as an SQL operator in the query without validation against an allowlist of comparison operators. The value is passed through esc_sql(), but since the payload operates as an operator (not inside quotes), esc_sql() has no effect on payloads that don't contain quote characters. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceThe ElementCamp WordPress plugin up to version 2.3.6 contains a SQL injection vulnerability in the tcg_select2_search_post AJAX action. The meta_query[compare] parameter accepts user input that is directly used as an SQL operator without allowlist validation. While esc_sql() is applied, it only escapes string literals within quotes—operators bypass this sanitization entirely, allowing authenticated attackers with Author-level access to inject arbitrary SQL operators for data exfiltration.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify ElementCamp plugin installation and versionNavigate to WordPress admin dashboard > Plugins > Installed Plugins, locate 'ElementCamp' and note the version number displayed, or inspect the plugin's main PHP file (usually elementcamp.php) and look for the 'Version:' header commentAffected if The plugin is installed and the version is 2.3.6 or lower
-
Locate the vulnerable AJAX action handlerIn the plugin directory, search for 'tcg_select2_search_post' in PHP files (grep -r 'tcg_select2_search_post' or use a code editor's search function). Examine the callback function that handles this AJAX action.Affected if The tcg_select2_search_post action handler exists in the plugin code
-
Verify the meta_query compare parameter handlingIn the AJAX callback, locate where $_POST['meta_query'] or similar input is processed. Check if the 'compare' key is extracted and used directly in WP_Query or $wpdb->prepare without an allowlist validation (such as in_array with a predefined list of allowed operators like '=', '!=', 'LIKE', etc.)Affected if The compare parameter is used without allowlist validation and passes user input directly as an SQL operator
-
Confirm esc_sql does not protect operatorsSearch for esc_sql() calls in the AJAX handler. Note that esc_sql() escapes string literals within quotes but does not validate or restrict SQL operators, operators like 'UNION' or 'BENCHMARK' passed as compare values bypass this sanitization entirely.Affected if esc_sql() is used but the compare operator bypasses it because operators are not enclosed in quotes during SQL construction
-
Check AJAX permission levelInspect the add_action calls for 'wp_ajax_tcg_select2_search_post' and 'wp_ajax_nopriv_tcg_select2_search_post'. Determine if nopriv (unauthenticated) access is allowed, or if only authenticated users (Author role or higher) can trigger the action.Affected if The AJAX action is accessible to Author-level users or lower without additional restrictions, allowing authenticated SQL injection
Your environment is affected if ElementCamp plugin version is 2.3.6 or lower, the tcg_select2_search_post AJAX action exists, and the meta_query[compare] parameter accepts user input without an allowlist restricting it to safe SQL operators.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUpgrade to version 2.3.7 or later, which should implement an allowlist for the compare parameter. Until a patch is available, restrict the tcg_select2_search_post AJAX action to higher-privilege users or disable the plugin.
Version greater than 2.3.6 (check WordPress plugin repository for latest stable release)
- 1. Log in to the WordPress admin dashboard with an Administrator account
- 2. Navigate to Plugins > Installed Plugins
- 3. Locate the ElementCamp plugin in the list
- 4. If an update is available, click 'Update Now' to update ElementCamp to the latest version (beyond 2.3.6)
- 5. After updating, verify the plugin version reflects a version newer than 2.3.6
- 6. Confirm the tcg_select2_search_post AJAX action now validates the compare parameter against an allowlist of permitted SQL operators
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation3.0 h
- Implementation4.0 h
- Testing4.0 h
- Review / QA3.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,936.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-2503 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-2503 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data