Smart Manager WordPress plugin: SQL injection via access_privileges parameter

Summary

The Smart Manager WooCommerce bulk edit plugin for WordPress is vulnerable to SQL injection through the 'access_privileges' parameter in all versions up to and including 8.97.0. An authenticated attacker with at least Subscriber access can append SQL queries to existing queries and extract sensitive data from the database, such as customer data, orders or user credentials. The issue only arises on sites where an administrator has saved a role-based deny-list Access Privilege configuration that does not explicitly block the internal 'access-privilege' module.

Affected

• Smart Manager (WordPress plugin, slug smart-manager-for-wp-e-commerce), all versions up to and including 8.97.0
• Only sites with a role-based deny-list Access Privilege configuration that does not explicitly block the 'access-privilege' module
• Default configuration: unaffected (per CNA)

Fixed in

• Conflicting information, not confirmed. Sources mention 8.97.1 and 8.98.0 as first fixed version.
• Verify the fixed version in the WordPress.org changelog or the vendor release notes before deploying.

Workaround

• Review Access Privilege settings and ensure the 'access-privilege' module is explicitly blocked for low-privilege roles (not confirmed by the vendor).
• Disable open subscriber registration if not needed and remove unused accounts.
• Deploy a Web Application Firewall with SQL injection detection rules as an additional layer (generic recommendation, not a verified fix).
• Disable the plugin if it is not needed for business operations.

Exploitation

• Not known to be exploited in the wild; not listed in the CISA KEV catalog according to one aggregator (catalog not checked directly).
• No public proof of concept confirmed in the sources; technical details are public and the flaw may be simple to reproduce.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS: unknown.

Our recommendation

• Check whether Smart Manager is installed on your WordPress and WooCommerce sites and which version is running.
• Update to the fixed version as soon as it is confirmed, at the next maintenance window at the latest.
• Review Access Privilege settings and restrict low-privilege accounts, especially where subscriber registration is open.
• Monitor logs for unusual requests to the plugin and review database access.
• Re-check KEV and EPSS status in the coming days.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Wordfence threat intelligence advisory www.wordfence.com
• Trac changeset (code fix reference) plugins.trac.wordpress.org
• Trac: class-smart-manager-pro-access-privilege.php (8.93.0) plugins.trac.wordpress.org
• VulDB CVE-2026-18443 vuldb.com
• Positive Technologies advisory (vulners) vulners.com
• PluginCheck Smart Manager plugincheck.io
• Strix CVE-2026-18443 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:38.