CVE-2026-40800

Summary

A SQL injection vulnerability exists in the ELEX WooCommerce Advanced Bulk Edit Products plugin version 1.5.3 and earlier, allowing unauthenticated attackers to execute arbitrary SQL commands against the WordPress database. This could lead to data exposure, manipulation, or even full database compromise.

Exploitability

The vulnerability is highly exploitable with no authentication required, as it affects a public-facing endpoint that processes subscriber data without proper input sanitization.

Blast radius

If exploited, this vulnerability could allow attackers to access sensitive customer and product data, potentially leading to unauthorized data modification or complete database takeover across affected WooCommerce installations.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.5.4 or later which contains the SQL injection fix for the subscriber data processing functionality.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.