SQL Injection Vulnerability in ELEX Product Feed for WooCommerce by ELEXtensions
CVE-2025-47643

7.6HIGH

Key Information:

Vendor

WordPress
Status
Elex Product Feed For WooCommerce
Vendor
CVE Published:
7 May 2025

What is CVE-2025-47643?

The ELEX Product Feed for WooCommerce from ELEXtensions is susceptible to a vulnerability that allows for SQL injection. This flaw permits malicious users to manipulate SQL queries within the application, potentially leading to unauthorized access to sensitive data or disruption of database operations. Affected versions range from unversioned to 3.1.2, emphasizing the urgency for users to review and implement the necessary security measures to mitigate potential exploitation.

Affected Version(s)

ELEX Product Feed for WooCommerce <= 3.1.2

References

https://patchstack.com/database/wordpress/plugin/elex-pro...
vdb-entry

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ngo Bui Truong Vu (Patchstack Alliance)
.
CVE-2025-47643 : SQL Injection Vulnerability in ELEX Product Feed for WooCommerce by ELEXtensions