CVE-2026-40800

30th percentile - higher than 30% of all known CVEs

The ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin in versions up to and including 1.5.3 contains a SQL Injection vulnerability exploitable by a Subscriber-level user. Only a low-privileged account is required.

An attacker with a basic account can inject malicious SQL queries, leading to disclosure, modification, or deletion of database data. This may result in customer data leakage and store takeover.

Update the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin to a version newer than 1.5.3. Until then, restrict subscriber registration.