A high-severity SQL injection flaw (CVE-2026-2413) has been discovered in the Ally WordPress Plugin, affecting 400,000+ installations.
The vulnerability allows unauthenticated attackers to extract sensitive data from WordPress databases.
What happened?
The issue stems from improper sanitization in a critical function, enabling attackers to inject malicious SQL queries through a URL parameter.
If exploited, attackers could perform time-based blind SQL injection to retrieve sensitive information.
Who is affected?
• All Ally plugin versions up to 4.0.3
• Exploitable when connected to an Elementor account with Remediation module enabled
Currently, only ~36% of sites have patched, leaving 250,000+ websites exposed.
Recommended actions
• Update Ally plugin to version 4.1.0 immediately
• Install the latest WordPress security update (6.9.2)
• Review database logs for suspicious queries
Even after 25 years, SQL injection remains one of the most common and dangerous web vulnerabilities.
