Description

Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-10-10T20:16:33.863Z",
  "pubdate": "2026-10-10T20:16:33.863Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress, specifically affecting versions 1.5.3 and below.\nThe vulnerability arises from insufficient neutralization of user-supplied data before incorporating it into database queries. This flaw allows an authenticated attacker with at least 'Subscriber' privileges to execute arbitrary SQL commands against the WordPress database.\nSuccessful exploitation poses a significant security risk, potentially leading to unauthorized data exfiltration, modification of database contents, or full administrative takeover of the WordPress instance. The attacker capabilities are limited only by the database permissions associated with the WordPress application, often leading to a complete compromise of confidentiality, integrity, and availability of the affected site.\nExploitation requires the attacker to be authenticated with a subscriber-level account, making the threat particularly potent for multi-user WordPress environments where user registration is enabled. No complex pre-conditions are required beyond basic account access.",
  "technicalDetails": "The vulnerability is a classic SQL injection resulting from the improper sanitation of user-controlled inputs passed to backend database queries. In the affected versions of the ELEX WooCommerce Advanced Bulk Edit plugin, specific AJAX actions or administrative handlers fail to implement robust input validation or parameterized queries, allowing malicious SQL fragments to be injected via parameters in HTTP requests.\nThe root cause lies in the application's failure to sanitize and validate input variables before embedding them directly into database queries executed by the $wpdb->get_results() or similar WordPress database abstraction methods. Because the plugin does not properly enforce capabilities or use preparation functions such as $wpdb->prepare(), the input is treated as executable code by the database management system.\nThe attack flow commences with the attacker authenticated as a subscriber. The attacker intercepts a request to the vulnerable plugin endpoint, identifying an input field that is subsequently reflected in the SQL query structure. By manipulating these parameters—for instance, by appending crafted SQL syntax (e.g., UNION SELECT statements, boolean-based inference, or error-based vectors)—the attacker can bypass the intended query logic.\nOnce the malicious payload reaches the server, the database executes the injected commands. An attacker can craft payloads to extract sensitive information from the wp_users table, such as password hashes, or modify products, settings, or user metadata. If the database user has elevated privileges, the attacker could theoretically perform operations that impact the underlying operating system or escalate privileges to administrator status by inserting a new malicious administrative user.\nThe vulnerability is exposed over the network, as the AJAX handlers are reachable by any logged-in user. The lack of proper nonce verification or capability checks (e.g., current_user_can('manage_woocommerce')) in the vulnerable functions further widens the attack surface, allowing unauthorized actors to perform operations intended only for site administrators or shop managers.\nPost-exploitation, the attacker maintains a persistent foothold by potentially modifying database rows to execute arbitrary code or by exfiltrating proprietary customer and store data, posing severe long-term risks to the integrity and confidentiality of the WooCommerce environment."
}