CVE-2025-47645: ELEX WooCommerce Bulk Edit SQLi Flaw

CVE-2025-47645 Overview

CVE-2025-47645 is a SQL Injection vulnerability in the ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress. The flaw stems from improper neutralization of special elements in SQL commands [CWE-89]. Authenticated users with low privileges, including subscribers, can inject SQL into backend database queries. The vulnerability affects all plugin versions up to and including 1.4.9.

Successful exploitation lets attackers read sensitive data from the WordPress database, including user records and session tokens. The issue is tracked through Patchstack and impacts WooCommerce stores running the affected plugin.

Critical Impact

Authenticated subscribers can execute arbitrary SQL queries, exposing confidential WordPress and WooCommerce data including customer records and credentials.

Affected Products

• ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin (basic edition)
• All versions from initial release through 1.4.9
• WordPress sites running WooCommerce with the vulnerable plugin installed

Discovery Timeline

• 2025-07-16 - CVE-2025-47645 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-47645

Vulnerability Analysis

The plugin processes user-supplied input and concatenates it into SQL queries without sufficient sanitization or use of prepared statements. WordPress provides the $wpdb->prepare() API for safe parameterized queries, but the affected code paths bypass this protection. The vulnerability is reachable by authenticated users at the subscriber role, which is the lowest privilege tier in WordPress and often grants near-anonymous access on sites permitting open registration.

The scope is marked as changed in the published advisory, indicating that exploitation can affect data beyond the plugin's own boundaries. Attackers can extract data from any table in the WordPress database, including wp_users, wp_usermeta, and WooCommerce order tables containing customer personally identifiable information (PII).

Root Cause

The root cause is improper neutralization of special elements used in SQL commands [CWE-89]. The plugin accepts parameters from HTTP requests and embeds them directly into database queries without escaping single quotes, SQL keywords, or query terminators. Reliance on client-side validation or trust in authenticated user roles compounds the issue.

Attack Vector

The attack is delivered over the network through standard HTTP requests to plugin endpoints. An attacker authenticates as any user with subscriber privileges or higher, then submits crafted parameters containing SQL syntax. Because subscriber accounts are commonly available on WooCommerce sites that permit customer registration, the barrier to entry is low. The vulnerability does not require user interaction beyond the attacker's own session.

No public proof-of-concept exploit is currently listed for CVE-2025-47645. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-47645

Indicators of Compromise

• HTTP requests to plugin endpoints containing SQL meta-characters such as ', --, UNION SELECT, SLEEP(, or INFORMATION_SCHEMA references
• Unexpected database errors logged by WordPress or MySQL referencing the plugin's query paths
• New or modified administrator accounts created shortly after subscriber-level authentication activity
• Bulk authentication from low-privilege accounts followed by high-volume POST requests to plugin AJAX handlers

Detection Strategies

• Enable WordPress debug logging and inspect wp-content/debug.log for WP_Error entries tied to $wpdb queries originating from the ELEX plugin
• Deploy a web application firewall (WAF) with SQL injection rule sets that inspect requests targeting /wp-admin/admin-ajax.php and ELEX plugin endpoints
• Correlate subscriber logins with subsequent administrative database queries through SIEM rules

Monitoring Recommendations

• Monitor MySQL slow query and error logs for malformed queries containing untypical UNION or subquery patterns
• Alert on outbound DNS or HTTP requests from the WordPress host that may indicate data exfiltration following SQL injection
• Track creation of new user accounts and role escalations in wp_users and wp_usermeta tables in near real time

How to Mitigate CVE-2025-47645

Immediate Actions Required

• Identify all WordPress installations running the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin and confirm the installed version
• Disable the plugin on affected sites until a patched version is installed if the plugin is not business-critical
• Disable open user registration or restrict the subscriber role on WooCommerce stores that do not require it
• Rotate WordPress administrator passwords, secret keys in wp-config.php, and WooCommerce API keys after remediation

Patch Information

The Patchstack advisory lists affected versions through 1.4.9. Site administrators should upgrade to the latest plugin release that addresses CVE-2025-47645 as published by ELEXtensions. Review the Patchstack Vulnerability Report for the fixed version reference.

Workarounds

• Deploy WAF rules that block SQL injection payloads targeting plugin AJAX and admin-post endpoints
• Restrict access to /wp-admin/ paths by IP allow-listing for administrative users
• Remove the subscriber role's ability to access the plugin's AJAX handlers through custom capability filters until a patch is applied

# Example WAF rule snippet (ModSecurity) blocking SQLi against ELEX plugin endpoints
SecRule REQUEST_URI "@contains elex-bulk-edit" \
  "phase:2,deny,status:403,id:1004765,\
   chain,msg:'Blocked potential SQLi against ELEX WooCommerce plugin (CVE-2025-47645)'"
  SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|information_schema|--\s|';)" "t:none"