SQL Injection Vulnerability in WP Bulk Delete Plugin for WordPress

CVE-2026-15727

What is CVE-2026-15727?

The WP Bulk Delete plugin for WordPress suffers from a significant SQL Injection flaw due to inadequate input sanitization on the 'delete_user_roles' parameter. This vulnerability affects all versions up to and including 1.4.2. Authenticated attackers with administrative privileges can exploit this weakness to inject arbitrary SQL commands, potentially gaining unauthorized access to sensitive data stored in the database. The failure to properly escape user input allows malicious actors to manipulate existing SQL queries and execute additional statements, bypassing standard safeguards like WordPress's magic quotes. Immediate action should be taken to mitigate this vulnerability.

References