The vulnerability is an SQL injection flaw caused by improper neutralization of special elements used in SQL commands in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin. The flaw permits blind SQL injection, meaning an attacker can execute arbitrary SQL statements against the WordPress database even if the query result is not directly returned. This can lead to unauthorized data disclosure, modification or deletion. The weakness is identified as CWE-89.

WordPress sites that have installed the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin in any version up to and including 1.4.9 are affected. The vulnerability is unrelated to specific WordPress core versions, so any site running the plugin within the affected range is vulnerable.

The CVSS score of 7.6 categorizes the vulnerability as high severity. An EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack is inferred to occur through the plugin’s web interface by submitting crafted requests that are passed to the database. This inference is drawn from the description of blind SQL injection and is not explicitly confirmed in the CVE data.