{"id":"CVE-2026-40800","published":"2026-10-10T20:16:33.863","lastModified":"2026-10-13T13:28:15.717","description":"Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/elex-bulk-edit-products-prices-attributes-for-woocommerce-basic/vulnerability/wordpress-elex-woocommerce-advanced-bulk-edit-products-prices-attributes-plugin-1-5-3-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A SQL injection vulnerability exists in the ELEX WooCommerce Advanced Bulk Edit Products plugin version 1.5.3 and earlier, allowing unauthenticated attackers to execute arbitrary SQL commands against the WordPress database. This could lead to data exposure, manipulation, or even full database compromise.","exploitability":"The vulnerability is highly exploitable with no authentication required, as it affects a public-facing endpoint that processes subscriber data without proper input sanitization.","blast_radius":"If exploited, this vulnerability could allow attackers to access sensitive customer and product data, potentially leading to unauthorized data modification or complete database takeover across affected WooCommerce installations.","remediation":"Upgrade to version 1.5.4 or later which contains the SQL injection fix for the subscriber data processing functionality.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","woocommerce","e-commerce","wp-plugin"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:48:29.654Z"}}