ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: SQL injection

Summary

The WordPress plugin ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes up to and including version 1.5.3 contains an SQL injection vulnerability (CWE-89). According to the CNA record, an authenticated user with Subscriber-level access can inject SQL queries, which could allow reading, modifying or deleting data in the WordPress database, including user accounts. The CVSS vector in the record (no privileges required) conflicts with the Subscriber requirement in the description, so the real risk depends on whether anyone can obtain a Subscriber account, for example through open self-registration.

Affected

• ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes (WordPress plugin, basic variant on WordPress.org)
• Versions up to and including 1.5.3

Fixed in

• Version 1.5.4 or later (according to Patchstack)

Workaround

• No vendor-published workaround known.
• Restrict or disable Subscriber self-registration on affected sites.
• Deactivate the plugin until the update is installed, if bulk editing is not needed.
• Use a web application firewall or virtual patch if available.

Exploitation

• Not marked as known exploited (KEV/ITW) in the sources reviewed.
• CISA SSVC: exploitation none, automatable no, technical impact partial.
• Patchstack describes the vulnerability as high priority and expects exploitation, but this is not confirmed by the sources reviewed.
• Public proof of concept: unknown.

Our recommendation

• Update the plugin to version 1.5.4 or later on all WooCommerce sites.
• Until then, inventory sites with this plugin at 1.5.3 or lower and disable or remove it where bulk editing is not needed.
• Review and limit Subscriber accounts and self-registration, and remove unneeded accounts.
• Monitor logs for unusual database errors or requests to the plugin's endpoints.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• WordPress.org plugin page wordpress.org
• ELEX changelog elextensions.com
• OpenCVE CVE-2026-40800 app.opencve.io
• Vulners (Rapid7 record) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:34.