External risk intelligence

ELEX WooCommerce Advanced Bulk Edit SQL Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-40800

This vulnerability exists in a WooCommerce plugin for WordPress. WordPress sites are frequently deployed as public-facing web applications. Plugins in this category are commonly accessible and reachable via the public internet as part of standard e-commerce and website operations.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical security issue found in an e-commerce plugin for WooCommerce that allows unauthorized access to and manipulation of product and pricing data through a SQL injection vulnerability. The vulnerability could potentially expose sensitive information or disrupt operations if exploited.

A security flaw exists in a WooCommerce plugin.
It allows unauthorized access to product and pricing data.
Confirm plugin relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted SQL queries over the network to a vulnerable WordPress site using the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin. This could allow them to manipulate the database, potentially leading to unauthorized access to sensitive information or disruption of service.

No authentication or user interaction needed.
Triggered by a malicious SQL query.
Risk of data exposure or service disruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious SQL code into the application. This could potentially lead to unauthorized access or modification of sensitive data stored in the database. The specific conditions for exploitation are not detailed in the provided advisory.

Database information could be exposed.
An attacker could send specially crafted requests.
Unauthorized access to sensitive data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in a WooCommerce plugin likely impacts e-commerce sites and requires immediate attention from platform or web application teams. The first step is to identify all instances of the affected plugin, confirm their exposure and business criticality, and then assign an owner for remediation.

Identify application and platform owners.
Verify plugin exposure and business criticality.
Plan and execute remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ELEX WooCommerce Advanced Bulk Edit plugin?

This is a WordPress plugin designed for e-commerce store owners to manage product catalogs, pricing, and attributes in bulk. It integrates directly with WooCommerce to streamline database updates. Because it handles complex database operations, the plugin must interact closely with the underlying WordPress SQL database to process changes requested by administrators.

What does SQL injection mean for CVE-2026-40800?

This vulnerability falls under the CWE-89 weakness class, which occurs when an application improperly filters user-supplied data before including it in a database query. In this case, the plugin fails to sanitize input, allowing an attacker to inject their own malicious SQL commands. This effectively tricks the database into executing unauthorized queries, potentially revealing sensitive information or altering store data.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specially crafted network requests to the vulnerable WordPress site. Because the vulnerability does not require authentication or user interaction, the attacker does not need an existing store account to send these requests. The bug is triggered specifically through web requests that reach the plugin's data-processing functions; standard browsing of public product pages without specific inputs will not trigger the issue.

Do I need to worry if my site uses this plugin?

According to Halo Surface Signal, you should consider this highly relevant if your site is public-facing. Because WordPress sites with e-commerce plugins are typically deployed on the open internet to process customer traffic, the interface used to trigger this vulnerability is reachable by anyone online. Sites that are strictly internal or firewalled may have a different risk profile, but public store fronts are directly exposed.

When should I take action on CVE-2026-40800?

You should act immediately by locating all WordPress installations running this specific plugin. Begin by confirming which sites are using version 1.5.3 or older, as these are the affected targets. Once identified, determine the business criticality of those specific stores and coordinate with the site owners to plan for updates or temporary mitigation while you verify the security of your database operations.

References

patchstack.com/database/wordpress/plugin/elex-bulk-edit-products-pri…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.