SQL Injection Vulnerability in Smart Manager Plugin for WooCommerce by WordPress
CVE-2026-18443

8.8HIGH

Key Information:

Vendor

WordPress
Status
Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (spreadsheet)
Vendor
CVE Published:
3 October 2026

What is CVE-2026-18443?

The Smart Manager plugin for WooCommerce is vulnerable to SQL injection via the 'access_privileges' parameter due to insufficient escaping mechanisms. Authenticated users with subscriber-level access can exploit this vulnerability if an administrator has incorrectly configured access privileges, allowing them to inject malicious SQL commands that can compromise the integrity of the database. This vulnerability poses a significant risk to installations where sensitive data may be exposed, as attackers can manipulate existing SQL queries to extract confidential information.

Affected Version(s)

Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet) 0 <= 8.97.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/smart-manager-...
https://plugins.trac.wordpress.org/browser/smart-manager-...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lhking
.