Smart Manager Woocommerce Bulk Edit
Monthly
Authenticated SQL injection in the Smart Manager - Advanced WooCommerce Bulk Edit & Inventory Management plugin (Pro edition) affects all versions up to and including 8.97.0, letting any account at subscriber level or above append arbitrary SQL to an existing query through the 'access_privileges' parameter and read sensitive data from the WordPress database. Exploitation is not unconditional: the site must also be in a non-default state where an administrator has saved a role-based deny-list Access Privilege configuration that does not explicitly block the internal 'access-privilege' module, which causes the authorization filter to implicitly permit low-privilege users to reach the vulnerable handler. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); note that while the supplied CVSS 3.1 vector is 8.8 High (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), our independent assessment rates effective severity lower (AC:H, I:L, A:N) because default installations and correctly configured deny-lists are not exploitable, valid authentication is mandatory, and only Pro-edition sites are in scope.
Authenticated SQL injection in the Smart Manager - Advanced WooCommerce Bulk Edit & Inventory Management plugin (Pro edition) affects all versions up to and including 8.97.0, letting any account at subscriber level or above append arbitrary SQL to an existing query through the 'access_privileges' parameter and read sensitive data from the WordPress database. Exploitation is not unconditional: the site must also be in a non-default state where an administrator has saved a role-based deny-list Access Privilege configuration that does not explicitly block the internal 'access-privilege' module, which causes the authorization filter to implicitly permit low-privilege users to reach the vulnerable handler. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); note that while the supplied CVSS 3.1 vector is 8.8 High (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), our independent assessment rates effective severity lower (AC:H, I:L, A:N) because default installations and correctly configured deny-lists are not exploitable, valid authentication is mandatory, and only Pro-edition sites are in scope.