CVE-2026-40800: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes

This vulnerability (CVE-2026-40800) is an improper neutralization of special elements used in an SQL command (CWE-89) in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress. Versions up to 1.5.3 are affected. The vulnerability allows remote attackers to perform SQL Injection without authentication, which can lead to unauthorized disclosure of sensitive data (confidentiality impact) and limited disruption of service (availability impact). The CVSS 3.1 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and scope changed.

Successful exploitation can lead to unauthorized access to sensitive database information (confidentiality impact) and partial denial of service (availability impact). Integrity impact is not indicated. The vulnerability can be exploited remotely without authentication or user interaction, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the affected plugin functionality or applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting this plugin.