CVE-2026-15727 is a SQL Injection vulnerability in the WP Bulk Delete plugin for WordPress affecting all versions up to and including 1.4.2. The vulnerability is caused by improper neutralization of special elements in the 'delete_user_roles' parameter, which is insufficiently escaped and not properly prepared in SQL queries. Authenticated users with administrator privileges can exploit this to append arbitrary SQL queries, potentially extracting sensitive database information. The root cause includes the use of wp_unslash() on raw POST data before parse_str(), which strips WordPress's magic-quotes protection and results in unescaped input reaching the SQL sink.

An authenticated attacker with administrator-level access can exploit this vulnerability to perform SQL Injection attacks. This can lead to unauthorized disclosure of sensitive information from the database. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure as per the CVSS vector (Confidentiality: High, Integrity: None, Availability: None).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to the 'delete_user_roles' parameter. Avoid using vulnerable versions of the plugin if possible.