CVE-2025-47645: 
WordPress vulnerability analysis and mitigation

CVE-2025-47645 is a SQL Injection vulnerability in the ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes WordPress plugin, affecting all versions up to and including 1.4.9. The flaw allows authenticated attackers with Subscriber-level privileges to inject malicious SQL commands into the application. It was reported by researcher Martino Spagnuolo (r3verii) on March 29, 2025, and published by Patchstack on July 15, 2025. The vulnerability carries a CVSS v3.1 base score of 8.5 (High) (Patchstack).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input is not properly sanitized or parameterized before being incorporated into database queries (Patchstack). Exploitation requires only Subscriber-level authentication (low privilege), and the attack is conducted over the network with no user interaction required. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) indicates a network-accessible, low-complexity attack with a changed scope, primarily impacting confidentiality (Feedly). No public proof-of-concept exploit code has been disclosed as of the publication date.

Successful exploitation allows an attacker with minimal privileges (Subscriber role) to directly interact with the WordPress site's underlying database, enabling unauthorized retrieval of sensitive data including user credentials, personal information, and WooCommerce order data. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the plugin itself to the broader database environment. While the primary impact is on confidentiality (rated High), limited availability impact is also present, and there is potential for further lateral movement if extracted credentials are reused (Patchstack).

No public proof-of-concept exploit code is currently known, and there is no confirmed evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.028%, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack has flagged this as high priority, noting that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites running the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin at version 1.4.9 or earlier using tools like WPScan or by inspecting plugin directories.
2. Obtain low-privilege access: Register or obtain a Subscriber-level account on the target WordPress site, which is the minimum privilege required for exploitation.
3. Identify vulnerable parameter: Locate the plugin's bulk edit functionality and identify the input parameter(s) that are passed unsanitized to database queries.
4. Craft SQL injection payload: Construct a malicious SQL payload (e.g., UNION-based or blind SQL injection) targeting the vulnerable parameter to extract data from the WordPress database.
5. Extract sensitive data: Use the injected query to retrieve sensitive information such as WordPress user table contents (usernames, hashed passwords, emails) or WooCommerce order data.
6. Post-exploitation: Use extracted credentials for privilege escalation or lateral movement within the WordPress environment (Patchstack).

• Logs: WordPress or web server access logs showing unusual or malformed requests to plugin-related endpoints (e.g., admin-ajax.php or plugin-specific REST routes) containing SQL metacharacters such as ', --, UNION, SELECT, or OR 1=1.
• Database: Unexpected or anomalous database queries in MySQL slow query logs or general query logs originating from the WordPress application user, particularly those involving UNION SELECT or information_schema references.
• Network: Repeated authenticated POST or GET requests from a single Subscriber-level account to bulk edit plugin endpoints in a short time window, potentially indicating automated exploitation.
• File System: New or modified files in the WordPress uploads or plugin directories that could indicate follow-on webshell deployment after credential extraction.

The vendor has released version 1.5.0 of the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin, which patches this vulnerability. Site administrators should update to version 1.5.0 or later immediately (Patchstack). As interim mitigations, deploying a Web Application Firewall (WAF) with SQL injection rules (Patchstack has issued a virtual patch/mitigation rule for its users), restricting Subscriber-level registration if not needed, and applying the principle of least privilege to database accounts are recommended. If immediate update is not possible, contact your hosting provider or web developer for assistance.

Patchstack, which discovered and coordinated disclosure of this vulnerability, has classified it as high priority and noted that SQL injection vulnerabilities of this type are commonly leveraged in mass-exploit campaigns against WordPress sites (Patchstack). The vulnerability was included in Wordfence's weekly WordPress vulnerability report for the week of July 14–20, 2025, and was referenced in CISA's vulnerability bulletin for the same week, indicating broad awareness within the WordPress security community.