The plugin contains an improper neutralization of special elements used in an SQL command, allowing an attacker to inject arbitrary SQL. This vulnerability (CWE-89) can enable an authenticated user with subscriber privileges to read, tamper with, or delete database content, compromising confidentiality and integrity. The flaw exists in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes up to and including version 1.4.9.

WordPress sites running the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin version 1.4.9 or earlier, published by ELEXtensions. No other vendors or product variants are explicitly listed.

The CVSS score of 8.5 marks it as a high‑severity issue. Although the EPSS score is less than 1%—indicating a low probability of automated exploitation—and the vulnerability is not listed in the CISA KEV catalog, the potential impact and the fact that a subscriber‑level role can trigger the injection mean the risk to sites remains significant. Successful exploitation would require a user authenticated as a subscriber with access to the bulk edit interface; once engaged, the attacker can execute the injected SQL against the database.