SQL Injection Vulnerability in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Plugin

CVE-2025-3280

What is CVE-2025-3280?

The ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress suffers from an SQL Injection vulnerability via the 'attribute_value_filter' parameter. This issue arises from improper escaping of user input and inadequate preparation of SQL queries. Authenticated attackers with Subscriber-level access and higher can manipulate existing queries to inject malicious SQL commands, potentially allowing them to extract sensitive data from the database.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References