ElementCamp <= 2.3.6 — Authenticated (Author+) SQL Injection via 'meta_query[compare]' Parameter

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under ElementCamp.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 2.3.8, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch ElementCamp to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Itthidej Aramsri (Boeing777).

The ElementCamp plugin for WordPress is vulnerable to time-based SQL Injection via the 'meta_query[compare]' parameter in the 'tcg_select2_search_post' AJAX action in all versions up to, and including, 2.3.6. This is due to the user-supplied compare value being placed as an SQL operator in the query without validation against an allowlist of comparison operators. The value is passed through esc_sql(), but since the payload operates as an operator (not inside quotes), esc_sql() has no effect on payloads that don't contain quote characters. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Mar 20, 2026

   CVE published

   Severity medium, CVSS 6.5

2. Nov 13, 2026

   Record last updated