The ELEX WooCommerce Google Shopping plugin contains an SQL Injection flaw in the file_to_delete parameter. The parameter is concatenated into SQL statements without proper escaping or prepared statements, allowing an administrator to inject arbitrary SQL. This can reveal sensitive data stored in the WordPress database, including customer details and product information, by creating additional SELECT or UPDATE clauses.

The bug affects all installations of the WordPress plugin ELEX WooCommerce Google Shopping (Google Product Feed) with versions up to and including 1.4.3. Any site running these plugin releases is vulnerable if an attacker can obtain Administrator or higher credentials.

With a CVSS score of 4.9 the vulnerability is considered medium impact, but because it requires authenticated admin rights the likelihood of exploitation is limited, reflected by an EPSS score of less than 1%. The vulnerability has not been listed in the CISA KEV catalog. The attack vector is an authenticated administrator who can modify the file_to_delete parameter, typically through the plugin's AJAX interface that is accessible only to users with sufficient permissions.