The vulnerability is a subscriber‑level SQL injection flaw that allows an attacker to inject arbitrary SQL statements into database queries. Exploiting this flaw could lead to unauthorized reading, modification, or deletion of WordPress and WooCommerce data, compromising both confidentiality and integrity. The weakness stems from insufficient input validation and sanitization when handling certain plugin requests, a classic example of the injection problems catalogued by CWE‑89.

The affected product is the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes WordPress plugin, version 1.5.3 or earlier. The vendor is ELEXtensions. Users running these versions on their WordPress sites are vulnerable.

The CVSS score of 9.3 indicates critical severity. Though the EPSS score is not available and the vulnerability is not yet listed in the CISA KEV catalog, the high CVSS score combined with a web‑based attack vector means the risk is still significant. An attacker that can authenticate as a subscriber or exploit the plugin's publicly exposed endpoints could immediately execute malicious SQL, potentially taking full control of the site’s database. Public exploit code has not yet been reported, but the vulnerability’s characteristics make it a strong candidate for rapid exploitation once disclosed.