CVSS 9.3 SQL Injection in ELEX WooCommerce Plugin 1.5.3 Lets Subscribers Manipulate Databases

The ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin contains a critical security flaw that allows attackers to inject malicious SQL code. The National Vulnerability Database assigned CVE-2026-40800 to this issue, rating it with a CVSS score of 9.3. This high severity score indicates that the vulnerability is easily exploitable and could lead to significant data compromise for websites using affected versions of the software.

In plain English

SQL injection is a technique where attackers insert malicious code into a website’s database queries. In this specific case, the flaw exists in how the ELEX plugin handles requests from subscribers. Attackers can manipulate these requests to execute unauthorized commands on the database. This can allow them to read, modify, or delete sensitive information stored within the WooCommerce platform, potentially exposing customer data or administrative credentials without proper authorization.

The background

The vulnerability is tracked as CVE-2026-40800 and is categorized under weakness CWE-89, which refers to SQL Injection. The National Vulnerability Database explicitly describes the issue as a Subscriber SQL Injection within the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin. The flaw impacts all versions of the plugin up to and including version 1.5.3. ELEXtensions is the vendor responsible for developing and maintaining this widely used WooCommerce extension for managing product data in bulk.

What changes now

Website administrators using the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin must verify their current version immediately. Any installation running version 1.5.3 or earlier is vulnerable to this critical SQL injection attack. Because the CVSS score is 9.3, the risk is considered severe. Users should check for vendor-provided updates to patch the flaw. Until a fix is confirmed and applied, sites remain exposed to potential data theft or database manipulation by malicious actors.

Background: SQL injection

Look for unexpected database errors, slow page loads, or logic bypasses. Check logs for tautologies and comment characters. Isolate affected inputs immediately and review parameterized query implementation.

Read the full guide: SQL Injection Warning Signs: Detecting Data Breaches Early

What to do and how to stay safe: ELEX WooCommerce

• Check your WordPress plugin list to see if ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes is installed and identify the current version number.
• If the version is 1.5.3 or lower, monitor the vendor’s official website or WordPress plugin page for a security update addressing CVE-2026-40800.
• Review database logs for unusual activity or unexpected queries that may indicate an attacker is exploiting the SQL injection vulnerability.
• Restrict access to the plugin’s bulk edit features to trusted administrators only, reducing the attack surface for lower-privileged subscriber accounts.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for this vulnerability?

The National Vulnerability Database rates CVE-2026-40800 with a CVSS score of 9.3, which is classified as Critical.

Which plugin versions are affected by this SQL injection flaw?

All versions of the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin up to and including version 1.5.3 are affected.

Is there a fix available for CVE-2026-40800?

No fix has been confirmed yet in the provided source material; users should wait for the vendor to release an update.