CVE-2026-40800: WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability

Q: What level of access does an attacker need to exploit this issue?

The issue is identified as a subscriber SQL injection, indicating that an attacker needs subscriber-level access. The provided CVSS vector also indicates that no additional privileges or user interaction are required.

Q: Can this be exploited remotely?

Yes. The CVSS attack vector is network-based (AV:N), and the attack complexity is low (AC:L), indicating exploitation can be attempted remotely without a complex attack setup.

Q: What impact could successful exploitation have?

The CVSS vector indicates high confidentiality impact, no integrity impact, and low availability impact. The scope is changed (S:C), meaning effects may extend beyond the vulnerable plugin's original security scope.

Published Oct 10, 2026

Updated

Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.

Affected Software

1 affected component

ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes<=1.5.3

Event History

Oct 10, 2026

CVE Published

via MITRE·07:34 PM

Data Sourced

via MITRE·07:34 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The issue is identified as a subscriber SQL injection, indicating that an attacker needs subscriber-level access. The provided CVSS vector also indicates that no additional privileges or user interaction are required.

Can this be exploited remotely?

Yes. The CVSS attack vector is network-based (AV:N), and the attack complexity is low (AC:L), indicating exploitation can be attempted remotely without a complex attack setup.

What impact could successful exploitation have?

The CVSS vector indicates high confidentiality impact, no integrity impact, and low availability impact. The scope is changed (S:C), meaning effects may extend beyond the vulnerable plugin's original security scope.

CVE-2026-40800: WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Can this be exploited remotely?

What impact could successful exploitation have?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Can this be exploited remotely?

What impact could successful exploitation have?