CVE-2025-47645
Lifecycle Timeline
2Tags
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows SQL Injection.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: from n/a through <= 1.4.9.
Analysis
SQL injection vulnerability in ELEX WooCommerce Advanced Bulk Edit Products plugin allows authenticated attackers to execute arbitrary SQL commands through unvalidated input in versions up to 1.4.9. The vulnerability requires subscriber-level or higher WordPress user privileges and carries low exploitation probability (EPSS 0.05%) despite its critical nature, suggesting limited practical attack incentive or complexity factors currently limiting real-world abuse.
Technical Context
The vulnerability stems from improper neutralization of special SQL metacharacters (CWE-89) in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress. This WordPress plugin extends WooCommerce functionality to enable bulk operations on product data. The plugin fails to properly sanitize or parameterize user-supplied input before incorporating it into SQL queries, allowing attackers with subscriber-level authentication to inject arbitrary SQL syntax. WordPress plugins execute within the WordPress database abstraction layer, and improper use of functions like wpdb::query() without prepared statements is the typical root cause. The affected plugin is distributed through WordPress.org plugin repository and identified by the slug elex-bulk-edit-products-prices-attributes-for-woocommerce-basic.
Affected Products
ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin (elex-bulk-edit-products-prices-attributes-for-woocommerce-basic) versions through 1.4.9 on WordPress installations with WooCommerce enabled. The plugin is hosted on WordPress.org plugin repository. Affected versions span from the plugin's earliest release through version 1.4.9 inclusive. Additional version details and patch confirmation available via the Patchstack vulnerability database reference.
Remediation
Update ELEX WooCommerce Advanced Bulk Edit Products plugin to version 1.5.0 or later, which addresses the SQL injection vulnerability through input sanitization and parameterized SQL queries. Users should navigate to WordPress Dashboard > Plugins, locate the ELEX plugin, and click 'Update' if available. If auto-updates are not enabled, manually download the patched version from the WordPress.org plugin repository. As an interim mitigation before patching, restrict subscriber role assignments to trusted users only, as the vulnerability requires subscriber-level WordPress authentication. Administrators should audit existing subscriber accounts and remove those no longer requiring access. Refer to the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/elex-bulk-edit-products-prices-attributes-for-woocommerce-basic/vulnerability/wordpress-elex-woocommerce-advanced-bulk-edit-products-prices-attributes-plugin-1-4-9-subscriber-sql-injection-vulnerability) for additional technical details and confirmation of patch availability.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today