SQL Injection Vulnerability in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Plugin
CVE-2025-3280
6.5MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 24 April 2025
What is CVE-2025-3280?
The ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress suffers from an SQL Injection vulnerability via the 'attribute_value_filter' parameter. This issue arises from improper escaping of user input and inadequate preparation of SQL queries. Authenticated attackers with Subscriber-level access and higher can manipulate existing queries to inject malicious SQL commands, potentially allowing them to extract sensitive data from the database.
Affected Version(s)
ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes * <= 1.4.9