Cyber Resilience

CVE-2026-40745

High

Published: 15 April 2026

Published
15 April 2026
Modified
22 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
EPSS Score 0.0004 12.1th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-40745 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 7.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Databases (T1213.006); ranked at the 12.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-40745 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability (CWE-89) that enables Blind SQL Injection in the bdthemes-element-pack-lite plugin for Element Pack Elementor Addons. This WordPress plugin is affected in all versions from n/a through 8.4.2.

The vulnerability carries a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), indicating it is exploitable remotely with low complexity by authenticated users possessing high privileges and no user interaction required. Attackers can achieve high confidentiality impact, such as extracting sensitive data from the database via blind SQL injection techniques, alongside low availability impact and a changed scope that may affect additional resources.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/bdthemes-element-pack-lite/vulnerability/wordpress-element-pack-elementor-addons-plugin-8-4-2-sql-injection-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Blind SQL Injection.This issue affects Element Pack Elementor Addons: from n/a through <= 8.4.2.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

The blind SQL injection vulnerability directly enables extraction of sensitive data from the database via crafted queries.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-30571Shared CWE-89
CVE-2024-57775Shared CWE-89
CVE-2026-29081Shared CWE-89
CVE-2026-48232Shared CWE-89
CVE-2025-30791Shared CWE-89
CVE-2026-32366Shared CWE-89
CVE-2024-57770Shared CWE-89
CVE-2025-23784Shared CWE-89
CVE-2025-22710Shared CWE-89
CVE-2025-31466Shared CWE-89

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

SI-10 requires validating and sanitizing information inputs, directly preventing blind SQL injection attacks like CVE-2026-40745 by neutralizing special elements in SQL commands.

SI-2 Flaw Remediation good match
preventrecover

SI-2 mandates identification, reporting, and correction of system flaws, ensuring timely patching of the SQL injection vulnerability in bdthemes-element-pack-lite versions <=8.4.2.

RA-5 Vulnerability Monitoring and Scanning good match
detect

RA-5 requires vulnerability monitoring and scanning, which identifies blind SQL injection vulnerabilities like CVE-2026-40745 in WordPress plugins prior to exploitation.

References