CVE-2026-103083: Authorization Bypass Through User-Controlled Key in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes

This vulnerability in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes arises from incorrectly configured access control security levels, allowing an attacker with some privileges to bypass authorization checks through a user-controlled key. The affected versions include all releases prior to 1.5.4. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact.

An attacker with some level of privileges can exploit this vulnerability to bypass authorization controls, potentially leading to unauthorized modification of product data or disruption of availability. There is no confidentiality impact reported. The integrity impact is limited, and availability impact is high, indicating possible denial of service or disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for suspicious activity related to bulk edit operations.