CVE-2025-22352

Summary

CVE-2025-22352 is an SQL Injection vulnerability affecting the ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin. The issue, which occurs up to version 1.4.8, allows an attacker to inject malicious SQL commands blindly due to improper neutralization of special elements. Successful exploitation could result in unauthorized access to sensitive data or the ability to modify or delete information within the affected WordPress installation. Users are advised to upgrade to the latest version of the plugin or consider alternative solutions to mitigate the risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.