CVE-2026-103083

MediumCVSS 5.4

Published: 15/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

The ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin (up to version 1.5.3) has an authorization bypass through user-controlled key vulnerability. This allows exploitation of incorrectly configured access control security levels.

Risk Assessment

An attacker could bypass access controls and perform unauthorized operations on products, prices, or attributes in the WooCommerce store.

Recommendation

Update the ELEX WooCommerce Advanced Bulk Edit plugin to the latest version (above 1.5.3) and review user permissions.

Other vulnerabilities in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes

CVE-2026-40800Critical
The ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin in versions up to and including 1.5.3 contains a SQL Injection vulnerability exploitable by a Subscriber-level user. Only a low-privileged account is required.

Original NVD description (English source)

Authorization Bypass Through User-Controlled Key vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: from n/a through 1.5.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS