CVE Intelligence
Analysis AI-assisted

CVE-2026-40800: ELEX WooCommerce Advanced Bulk Edit (WordPress) - SQL Injection

An SQL injection vulnerability (CWE-89) in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress affects versions up to and including 1.5.3. Patchstack scored it 9.3 under CVSS 3.1, and the record lists no fixed version. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

This record describes an SQL injection flaw (CWE-89) in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress, affecting versions up to and including 1.5.3. Patchstack published the entry as the CNA. The vendor entry is available in the Patchstack database.

Impact

  • The CVSS 3.1 base score is 9.3 (critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L.
  • The vector indicates high confidentiality impact, no integrity impact, low availability impact, and a scope change.
  • A successful SQL injection could expose data stored in the site database. The record does not describe which data would be reachable.

Affected products and versions

  • Product: ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes.
  • Versions: up to and including 1.5.3, as stated in the record.
  • The record lists no fixed version.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record.
  • No confirmed exploitation appears in the sources consulted.
  • The SSVC fields in the record show exploitation none, automatable no, and partial technical impact.
  • The EPSS probability is low (dated 2026-10-13), which is consistent with limited observed exploitation interest.

Remediation and mitigation

  • Identify every site running this plugin and its installed version.
  • Check the vendor and Patchstack entries for a release newer than 1.5.3, since the record lists no fix.
  • If no fixed release is confirmed, consider disabling the plugin until an update is available.
  • Review accounts with low privileges, since the description refers to a Subscriber-level role, and limit account registration where it is not needed.
  • Apply least privilege to the database account used by WordPress.

Detection guidance

  • Review web server and WAF logs for unusual requests to the plugin's bulk edit functions, especially those producing database error messages or abnormal parameter values.
  • Audit recent bulk changes to product prices and attributes for modifications nobody approved.
  • Monitor for newly created or unfamiliar user accounts, especially low-privilege accounts.

Limitations of the available information

  • The record does not identify the vulnerable endpoint, parameter, or technical conditions, and this analysis does not add them.
  • The description refers to a Subscriber-level account, but the CVSS vector sets privileges required to none. The record does not resolve this difference.
  • No fixed version, vendor advisory, or patch date appears in the record.
  • The NVD and CVE.org pages are listed as sources, but this analysis relies only on the data supplied in the record.

Frequently asked questions

What is CVE-2026-40800?

It is an SQL injection vulnerability (CWE-89) in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress, affecting versions up to and including 1.5.3.

Is this CVE known to be exploited?

The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.

Is there a fixed version?

The record does not list a fixed version. Check the vendor and Patchstack entries for an update newer than 1.5.3.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.