CVE-2026-40800: WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability

Q: What level of access does an attacker need to exploit this issue?

The issue is identified as a subscriber SQL injection, indicating that an attacker needs subscriber-level access. The provided CVSS vector also indicates that no additional privileges or user interaction are required.

Q: Can this be exploited remotely?

Yes. The CVSS attack vector is network-based (AV:N), and the attack complexity is low (AC:L), indicating exploitation can be attempted remotely without a complex attack setup.

Q: What impact could successful exploitation have?

The CVSS vector indicates high confidentiality impact, no integrity impact, and low availability impact. The scope is changed (S:C), meaning effects may extend beyond the vulnerable plugin's original security scope.

Published Oct 10, 2026

Updated

Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.

Affected Software

1 affected component

ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes<=1.5.3

Event History

Oct 10, 2026

CVE Published

via MITRE·07:34 PM

Data Sourced

via MITRE·07:34 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The issue is identified as a subscriber SQL injection, indicating that an attacker needs subscriber-level access. The provided CVSS vector also indicates that no additional privileges or user interaction are required.

Can this be exploited remotely?

Yes. The CVSS attack vector is network-based (AV:N), and the attack complexity is low (AC:L), indicating exploitation can be attempted remotely without a complex attack setup.

What impact could successful exploitation have?