What is the CVSS score of CVE-2025-47645?

CVE-2025-47645 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

WordPress CVE-2025-47645

Q: Which versions of WordPress are affected by CVE-2025-47645?

SQL injection vulnerability in ELEX WooCommerce Advanced Bulk Edit Products plugin allows authenticated attackers to execute arbitrary SQL commands through unvalidated input in versions up to 1.4.9.

HIGH

SQL Injection (CWE-89)

2025-07-16 audit@patchstack.com

WordPress SQLi

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:42 NVD

8.5 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:43 vuln.today

CVE Published

Jul 16, 2025 - 12:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows SQL Injection.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: from n/a through <= 1.4.9.

AnalysisAI

SQL injection vulnerability in ELEX WooCommerce Advanced Bulk Edit Products plugin allows authenticated attackers to execute arbitrary SQL commands through unvalidated input in versions up to 1.4.9. The vulnerability requires subscriber-level or higher WordPress user privileges and carries low exploitation probability (EPSS 0.05%) despite its critical nature, suggesting limited practical attack incentive or complexity factors currently limiting real-world abuse.

Technical ContextAI

The vulnerability stems from improper neutralization of special SQL metacharacters (CWE-89) in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress. This WordPress plugin extends WooCommerce functionality to enable bulk operations on product data. The plugin fails to properly sanitize or parameterize user-supplied input before incorporating it into SQL queries, allowing attackers with subscriber-level authentication to inject arbitrary SQL syntax. WordPress plugins execute within the WordPress database abstraction layer, and improper use of functions like wpdb::query() without prepared statements is the typical root cause. The affected plugin is distributed through WordPress.org plugin repository and identified by the slug elex-bulk-edit-products-prices-attributes-for-woocommerce-basic.

Affected ProductsAI

ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin (elex-bulk-edit-products-prices-attributes-for-woocommerce-basic) versions through 1.4.9 on WordPress installations with WooCommerce enabled. The plugin is hosted on WordPress.org plugin repository. Affected versions span from the plugin's earliest release through version 1.4.9 inclusive. Additional version details and patch confirmation available via the Patchstack vulnerability database reference.

RemediationAI

Update ELEX WooCommerce Advanced Bulk Edit Products plugin to version 1.5.0 or later, which addresses the SQL injection vulnerability through input sanitization and parameterized SQL queries. Users should navigate to WordPress Dashboard > Plugins, locate the ELEX plugin, and click 'Update' if available. If auto-updates are not enabled, manually download the patched version from the WordPress.org plugin repository. As an interim mitigation before patching, restrict subscriber role assignments to trusted users only, as the vulnerability requires subscriber-level WordPress authentication. Administrators should audit existing subscriber accounts and remove those no longer requiring access. Refer to the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/elex-bulk-edit-products-prices-attributes-for-woocommerce-basic/vulnerability/wordpress-elex-woocommerce-advanced-bulk-edit-products-prices-attributes-plugin-1-4-9-subscriber-sql-injection-vulnerability) for additional technical details and confirmation of patch availability.