Critical SQL Injection Flaw Found in ELEX WooCommerce Plugin Versions 1.5.3 and Below

The National Vulnerability Database recorded a critical security vulnerability in the ELEX WooCommerce Advanced Bulk Edit Products plugin on this date. The flaw, identified as CVE-2026-40800, allows for subscriber SQL injection attacks against installations running version 1.5.3 or earlier. This discovery highlights significant risks for e-commerce sites relying on this specific tool for managing product data efficiently.

Security researchers assigned a CVSS score of 9.3 to this vulnerability, classifying it as critical severity. The underlying weakness is categorized under CWE-89, which denotes improper neutralization of special elements used in an SQL command. This classification indicates that the plugin fails to properly sanitize user input, allowing attackers to manipulate database queries through the subscriber interface.

Context and Background

SQL injection remains one of the most dangerous web application vulnerabilities due to its potential for complete database compromise. When an application does not validate or sanitize input, malicious actors can insert arbitrary SQL code. This code executes on the backend server, potentially exposing sensitive customer data, administrative credentials, or financial records stored within the WooCommerce database.

The ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin is designed to help store administrators manage large inventories. By enabling bulk modifications to product attributes and pricing, it streamlines operations for merchants. However, the convenience of bulk editing introduces complex input handling requirements that, if not secured, create exploitable entry points for attackers.

Who is Affected

Only users of the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin are affected by this specific vulnerability. The National Vulnerability Database specifies that all versions up to and including 1.5.3 contain the flaw. Merchants who have not updated their installation since the release of version 1.5.3 are currently exposed to potential SQL injection attacks.

Site owners using newer versions of the plugin are not affected by CVE-2026-40800 according to the current record. However, administrators must verify their exact plugin version in the WordPress dashboard. Any installation showing version 1.5.3 or lower requires immediate attention to mitigate the risk of unauthorized database access or data exfiltration by malicious subscribers.

What should you do?

No patch or fix has been confirmed yet for this specific vulnerability in the provided source material. Administrators should monitor official channels from ELEXtensions for an updated version that addresses CVE-2026-40800. In the interim, restricting subscriber capabilities and monitoring database queries for unusual activity can help detect potential exploitation attempts before significant damage occurs.