PT-2025-29798 · WordPress · Elex Woocommerce Advanced Bulk Edit Products

Martino Spagnuolo · Published 2025-07-16 · Updated 2025-07-16 · CVE-2025-47645

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes versions through 1.4.9

Description The software contains a SQL injection flaw due to improper neutralization of special elements used in an SQL command. This allows for potential SQL injection attacks.

Recommendations Update ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes to a version later than 1.4.9.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-47645

Affected Products

Elex Woocommerce Advanced Bulk Edit Products

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-47645 · Security Note
• https://patchstack.com/database/wordpress/plugin/elex-bulk-edit-products-prices-attributes-for-woocommerce-basic/vulnerability/wordpress-elex-woocommerce-advanced-bulk-edit-products-prices-attributes-plugin-1-4-9-subscriber-sql-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1945482489717563534 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/elex-bulk-edit-products-prices-attributes-for-woocommerce-basic/vulnerability/wordpress-elex-woocommerce-advanced-bulk-edit-products-prices-attributes-plugin-1-4-9-subscriber-sql-injection-vulnerability?_s_id=cve · Note