An attacker can exploit a SQL injection vulnerability in Elementor Website Builder version less than 3.12.2 by sending a malicious payload through the 'Replace URL' feature. By executing a specific SQL command, the attacker can make the server hang for 2 seconds, indicating a successful injection.