CVE-2025-10046: ELEX WooCommerce Google Shopping SQL Injection

CVE-2025-10046 Overview

The ELEX WooCommerce Google Shopping (Google Product Feed) plugin for WordPress contains a SQL Injection vulnerability in the file_to_delete parameter. The flaw affects all versions up to and including 1.4.3. It stems from insufficient escaping on the user-supplied parameter combined with a lack of preparation on the existing SQL query. Authenticated attackers with Administrator-level access or above can append additional SQL queries onto existing statements. The injected queries can extract sensitive information from the WordPress database. The issue is tracked under CWE-89 and is addressed in plugin version 1.4.4.

Critical Impact
Authenticated administrators can inject arbitrary SQL through the file_to_delete parameter and exfiltrate sensitive data from the WordPress database.

Affected Products

ELEX WooCommerce Google Shopping (Google Product Feed) plugin for WordPress, versions ≤ 1.4.3
WordPress sites running the vulnerable plugin with the WooCommerce extension enabled
Multi-site WordPress installations where administrators manage product feeds via this plugin

Discovery Timeline

2025-09-06 - CVE-2025-10046 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10046

Vulnerability Analysis

The vulnerability resides in the plugin's AJAX handler defined in includes/elex-manage-feed-ajax.php. When an administrator triggers a file deletion action, the file_to_delete request parameter is passed into a SQL statement without proper sanitization or parameterization. Because the raw input is concatenated into the query, an attacker can terminate the intended statement and append additional SQL clauses. Exploitation requires authenticated access at the Administrator level or higher, which limits mass exploitation but remains relevant for scenarios involving compromised admin credentials, insider threats, or multi-tenant hosting environments.

Root Cause

The root cause is a classic failure to use prepared statements. The plugin does not apply wpdb::prepare() or equivalent escaping helpers such as esc_sql() when incorporating the file_to_delete value into the SQL query. This omission converts a routine file-management action into a stacked-query injection primitive against the underlying MySQL or MariaDB database.

Attack Vector

An authenticated administrator sends a crafted AJAX request to the plugin's feed management endpoint with a malicious file_to_delete payload. The payload closes the original query and appends attacker-controlled SQL, such as UNION SELECT statements targeting wp_users or wp_usermeta. The server executes the appended query and returns or logs data that the attacker can retrieve. Because the attack originates from an authenticated administrator session, standard WordPress nonce checks and capability checks do not block the injection itself.

Refer to the WordPress Plugin Change Log and the patched source in 1.4.4 for the specific code paths.

Detection Methods for CVE-2025-10046

Indicators of Compromise

POST requests to admin-ajax.php containing the file_to_delete parameter with SQL metacharacters such as single quotes, semicolons, UNION, SELECT, SLEEP, or comment markers (--, #, /*).
Unexpected reads of wp_users, wp_usermeta, or wp_options tables in MySQL general or slow query logs, correlated with plugin AJAX activity.
New or modified administrator accounts created shortly after suspicious file_to_delete requests.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect the file_to_delete parameter for SQL keywords and block or alert on anomalous input.
Enable MySQL query logging and hunt for UNION SELECT, INTO OUTFILE, or time-based payloads originating from the WordPress database user.
Baseline normal administrator activity for the plugin and alert on out-of-band requests to the feed management AJAX endpoint.

Monitoring Recommendations

Forward WordPress access logs, PHP error logs, and MySQL logs to a centralized SIEM for correlation across administrator sessions.
Monitor for privilege escalation events, password hash reads, and secret extraction attempts that follow administrator authentication anomalies.
Track plugin version inventory across WordPress deployments and alert when hosts continue running vulnerable versions of the ELEX plugin.

How to Mitigate CVE-2025-10046

Immediate Actions Required

Upgrade the ELEX WooCommerce Google Shopping (Google Product Feed) plugin to version 1.4.4 or later on all WordPress instances.
Audit administrator accounts, rotate credentials, and enforce multi-factor authentication for every user with the manage_options capability.
Review WordPress and database logs for prior exploitation attempts referencing the file_to_delete parameter.

Patch Information

The vendor addressed the vulnerability in version 1.4.4. The fix introduces proper parameterization and input validation on the file_to_delete value inside elex-manage-feed-ajax.php. Review the patch commit at the WordPress Plugin Update Notes and the Wordfence Vulnerability Advisory for additional detail.

Workarounds

Deactivate the ELEX WooCommerce Google Shopping plugin until the upgrade to 1.4.4 is completed.
Restrict administrator access via IP allowlists on /wp-admin/ and admin-ajax.php to reduce the exposure of the vulnerable endpoint.
Apply a virtual patch through a WAF that blocks SQL metacharacters in the file_to_delete parameter for the plugin's AJAX action.

bash

# Example ModSecurity rule blocking SQLi patterns in file_to_delete
SecRule ARGS:file_to_delete "@rx (?i)(union(\s|/\*.*\*/)+select|;|--|/\*|\bsleep\s*\(|\binto\s+outfile\b)" \
    "id:1010046,phase:2,deny,status:403,log,msg:'CVE-2025-10046 ELEX Plugin SQLi attempt'"