This vulnerability in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes (up to version 1.4.9) arises from improper neutralization of special elements in SQL commands, enabling blind SQL injection attacks. The CVSS 3.1 score is 7.6 (high), with an attack vector of network, low attack complexity, requiring high privileges, no user interaction, and a scope change. The impact includes high confidentiality impact and low availability impact, with no integrity impact. No patch or official remediation guidance is currently available from the vendor or public advisories.

Successful exploitation allows an attacker with high privileges to perform blind SQL injection, potentially leading to unauthorized access to sensitive data (confidentiality impact) and partial denial of service (availability impact). There is no indication of integrity compromise. The vulnerability affects the confidentiality of the database and may disrupt service availability to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege access to the affected plugin and monitor for unusual database activity. Avoid exposing the plugin to untrusted users with elevated privileges. Follow vendor channels for updates on patches or mitigations.