This vulnerability is an Insecure Direct Object Reference in the WordPress plugin that allows an attacker to manipulate product data by changing identifiers passed in requests. The flaw permits an actor who can control a request key to read or modify any product, enabling unauthorized changes to pricing, attributes or inventory—an instance of privilege escalation consistent with CWE‑639.

The issue applies to the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin from its initial release up to and including version 1.5.3. Users running the plugin on WordPress sites should verify their installed version against 1.5.4, the first release that contains the fix.

The CVSS score of 5.4 indicates a moderate severity for potential confidentiality, integrity, and availability impacts. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting that no widely available exploit is known at this time. Exploitation would typically occur through crafted HTTP requests sent to the plugin's endpoints, so an attacker with network access to the site and knowledge of the plugin's URL structure could gain unauthorized product control.