Elex Woocommerce Advanced Bulk Edit Products Prices Attributes
Monthly
SQL injection in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes WordPress plugin (versions 1.5.3 and earlier) lets an attacker inject arbitrary SQL through an unsanitized request parameter and read sensitive data from the site's underlying WordPress/WooCommerce database. The vendor-published CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) and the CWE is CWE-89; however, our independent assessment rates the same vector at PR:L because the vulnerability is titled a 'Subscriber' SQL injection, indicating that a logged-in low-privilege account (subscriber role) is the practical prerequisite - a requirement easily satisfied on sites with open user registration. Per the assessed vector this is an authenticated (PR:L), remotely reachable, network-based injection with no user interaction, high confidentiality impact, low availability impact, and no public exploit code identified at time of analysis; the CVSS privilege-level discrepancy between vendor (PR:N) and our assessment (PR:L) should be confirmed with the vendor.
Authorization bypass through user-controlled key (CWE-639 / IDOR) in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes WordPress plugin, affecting versions through 1.5.3, lets an authenticated low-privilege user supply or alter object identifiers in bulk-edit requests so the plugin acts on products, prices or attributes that user is not authorized to change, producing limited integrity and availability impact. Authentication is mandatory (CVSS PR:L) so anonymous visitors cannot trigger it, and there is no data disclosure (C:N) per the assessed vector. At time of analysis no public exploit code exists and the issue is not listed in CISA KEV, so practical risk depends on an attacker obtaining a valid low-privileged account on an affected WordPress/WooCommerce site.
SQL injection in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes WordPress plugin (versions 1.5.3 and earlier) lets an attacker inject arbitrary SQL through an unsanitized request parameter and read sensitive data from the site's underlying WordPress/WooCommerce database. The vendor-published CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) and the CWE is CWE-89; however, our independent assessment rates the same vector at PR:L because the vulnerability is titled a 'Subscriber' SQL injection, indicating that a logged-in low-privilege account (subscriber role) is the practical prerequisite - a requirement easily satisfied on sites with open user registration. Per the assessed vector this is an authenticated (PR:L), remotely reachable, network-based injection with no user interaction, high confidentiality impact, low availability impact, and no public exploit code identified at time of analysis; the CVSS privilege-level discrepancy between vendor (PR:N) and our assessment (PR:L) should be confirmed with the vendor.
Authorization bypass through user-controlled key (CWE-639 / IDOR) in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes WordPress plugin, affecting versions through 1.5.3, lets an authenticated low-privilege user supply or alter object identifiers in bulk-edit requests so the plugin acts on products, prices or attributes that user is not authorized to change, producing limited integrity and availability impact. Authentication is mandatory (CVSS PR:L) so anonymous visitors cannot trigger it, and there is no data disclosure (C:N) per the assessed vector. At time of analysis no public exploit code exists and the issue is not listed in CISA KEV, so practical risk depends on an attacker obtaining a valid low-privileged account on an affected WordPress/WooCommerce site.