This vulnerability (CVE-2025-47645) affects the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress, specifically versions up to 1.4.9. It is caused by improper neutralization of special elements used in SQL commands, leading to an SQL Injection flaw. The CVSS 3.1 base score is 8.5, indicating high severity, with attack vector network, low attack complexity, requiring low privileges, no user interaction, and a scope change. The impact includes high confidentiality compromise and low availability impact. No patch or vendor advisory is provided in the data, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker with low privileges to execute unauthorized SQL commands on the affected system. This may lead to unauthorized disclosure of sensitive information (high confidentiality impact) and partial disruption of service (low availability impact). Integrity impact is not indicated. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the plugin functionality to trusted users only and monitor for unusual activity related to database queries. Avoid exposing administrative interfaces to untrusted networks.