ELEX Bulk Edit CVE-2026-40800

Exploitation targets the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin at version 1.5.3 or earlier via an unsanitized parameter in a plugin request that is concatenated into a SQL query (CWE-89). The vulnerability title designates it a 'Subscriber' SQL injection, meaning a logged-in subscriber-level account is the intended prerequisite, most easily met on sites with open user registration enabled - note this limiting factor contradicts the published CVSS PR:N and should be confirmed with the vendor. The limiting factors are therefore: presence of the vulnerable plugin version, a WooCommerce/WordPress deployment, and (per the title) at least a low-privilege authenticated account. No user interaction is required (UI:N).

This is a CWE-89 SQL injection in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin (<= 1.5.3), reported by Patchstack with a CVSS 3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L). The signals conflict in an important way: the vulnerability title explicitly says 'Subscriber SQL Injection', which implies an authenticated subscriber-level account is required, yet the published CVSS vector encodes PR:N (no privileges). Per the analysis rules, authentication state is taken from the vector, so the vector as given indicates unauthenticated access; however this directly contradicts the 'Subscriber' designation and should be verified with Patchstack/the vendor - most Patchstack 'Subscriber' findings in practice require at least a logged-in subscriber account (PR:L). The remaining metrics are consistent with a network-reachable, low-complexity injection yielding high confidentiality impact with a scope change (S:C) to the backend database and low availability impact. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: the high score is driven by easy network reachability and database read access, but real-world priority is moderated by the likely requirement for a (low-privilege) authenticated account and the absence of any exploitation or POC signal. For WordPress sites that allow open subscriber registration this should be treated as a genuine priority; for sites with closed registration the realistic risk is lower.

An attacker obtains or self-registers a low-privilege WordPress account (subscriber) on a site running the vulnerable ELEX bulk-edit plugin, then sends a crafted request to an affected plugin endpoint with a malicious SQL payload in an unsanitized parameter. The injection executes against the WordPress database, letting the attacker read sensitive data such as user records, password hashes, and secret material. No public proof-of-concept was provided in the input.