ELEX Bulk Edit EUVD-2026-102236

Exploitation requires an authenticated account of at least low privilege (CVSS PR:L) on a WordPress/WooCommerce site running ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes version n/a through 1.5.3, with the plugin's bulk-edit functionality in use. The flaw is an insecure direct object reference where the plugin trusts a user-controlled key instead of verifying the requesting user's authorization for that object, so the attacker must be able to reach the plugin's authenticated bulk-edit endpoint and supply/modify the object identifier. Limiting factors: valid authentication is mandatory (not exploitable by anonymous visitors), impact is bounded to limited integrity and availability (C:N, I:L, A:L) with no data disclosure, and the plugin must be installed and active.

This is a moderate-severity Authorization Bypass / IDOR (CWE-639) in a WooCommerce plugin, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 5.4) indicates a network-reachable, low-complexity flaw that requires an authenticated account at low privilege (PR:L) and yields only limited integrity and availability impact with no confidentiality exposure (C:N). No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied in the input. Based on precision rules, exploitation status is 'no public exploit identified at time of analysis.' The authentication requirement (PR:L, so an attacker needs at least a valid low-privilege account such as a shop manager/customer or any authenticated role the plugin trusts) meaningfully lowers real-world risk, as does the absence of any confidentiality impact and the lack of KEV/EPSS evidence of active or probable exploitation. This should be treated as a routine patch-management item - a genuine but not emergency priority - rather than a high-urgency flaw, given it is a vendor-specific WordPress plugin with authentication required and bounded (low integrity/availability) impact. EPSS is absent, not low, so no exploitation-probability inference can be drawn either way.

An authenticated low-privilege user on a WooCommerce store running the plugin manipulates a user-controlled object identifier (e.g., a product, price, or attribute reference) in a bulk-edit request to act on records they should not be authorized to modify. Because the access-control check relies on the user-supplied key, the attacker can alter product data or pricing/attributes outside their authorization scope. No public exploit code was identified in the provided data, and exploitation requires a valid authenticated session.