EUVD-2026-44900
GHSA-g6hr-2vmc-344h
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Administrator credentials required (PR:H); AJAX endpoint is network-reachable with no complexity (AV:N, AC:L); read-only SQL injection yields high confidentiality but zero integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WP Bulk Delete plugin for WordPress is vulnerable to generic SQL Injection via the 'delete_user_roles' parameter in all versions up to, and including, 1.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. wp_unslash() is applied to the raw POST body before parse_str() decomposes it, stripping WordPress magic-quotes protection and leaving attacker-controlled values fully unescaped prior to reaching the SQL sink.
AnalysisAI
SQL injection in the WP Bulk Delete WordPress plugin (all versions up to and including 1.4.2) allows authenticated attackers holding administrator-level privileges to append arbitrary SQL to existing queries via the delete_user_roles POST parameter, enabling full database read access. The root cause is a code-level stripping of WordPress's built-in magic-quotes protection: wp_unslash() is called on the raw POST body before parse_str() decomposes it, leaving attacker-controlled values fully unescaped when they reach the SQL sink in class-delete-api.php. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; real-world risk is bounded by the administrator authentication requirement.
Technical ContextAI
The affected product is the WP Bulk Delete plugin by vendor Xylus (CPE: cpe:2.3:a:xylus:wp_bulk_delete:*:*:*:*:*:*:*:*), a WordPress plugin used for bulk deletion of users, posts, and related content. The vulnerability class is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). WordPress's wpdb layer normally mitigates injection risk through magic-quote slashing applied at request ingestion, but this plugin explicitly calls wp_unslash() on the raw POST body before passing it to parse_str(), which decomposes it into PHP variables. This sequence destroys the protective escaping that WordPress applies, so by the time the delete_user_roles value reaches the SQL construction logic in includes/class-delete-api.php (lines 1071 and 1113 in both the 1.4.1 and 1.4.2 tags), it is fully attacker-controlled and unescaped. The AJAX entry points are in includes/ajax-delete-handler.php at lines 36 and 118. No use of parameterized queries or wpdb::prepare() is applied at the sink, allowing SQL clause injection.
RemediationAI
Update WP Bulk Delete to a release version that incorporates the upstream fix committed to plugin trunk in SVN changeset 3608270 (https://plugins.trac.wordpress.org/changeset/3608270/wp-bulk-delete/trunk/includes/class-delete-api.php); no specific patched release version number has been independently confirmed from the available data, so monitor the WordPress plugin repository for a release beyond 1.4.2. If an immediate update is not possible, restrict WordPress administrator credentials to the minimum set of fully trusted users, as exploitation is gated entirely on administrator-level authentication. As a compensating control, deploy WAF rules targeting SQL injection patterns in the delete_user_roles POST parameter - Wordfence premium subscribers may receive automatic firewall rule coverage prior to a plugin update being released, though WAF rules are bypassable and should not be treated as a permanent fix. Disabling the WP Bulk Delete plugin entirely eliminates the attack surface if bulk-delete functionality is non-essential.
More in Wp Bulk Delete
View allImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WP Bu
Missing Authorization vulnerability in Xylus Themes WP Bulk Delete allows Exploiting Incorrectly Configured Access Contr
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today