CVE-2026-18443
HighCVSS 8.8Summary
The Smart Manager plugin for WordPress is vulnerable to generic SQL injection via the 'access_privileges' parameter in versions up to and including 8.97.0. Authenticated attackers with subscriber-level access and above can append SQL queries to existing queries to extract sensitive information from the database. Exploitation is only possible when an administrator has saved a role-based deny-list configuration that does not block the internal 'access-privilege' module.
Risk Assessment
The risk involves potential leakage of sensitive data from the WordPress database, including user data and content. Attackers with minimal privileges could access information that should be protected.
Recommendation
Immediately update the Smart Manager plugin to the latest available version that includes a fix. Additionally, review the deny-list configuration to ensure the 'access-privilege' module is blocked for low-privilege users.
Other vulnerabilities in Smart Manager
See all- CVE-2026-57704High
The Smart Manager plugin version 8.90.0 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
- CVE-2026-45216High
The Smart Manager plugin for WordPress contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions up to and including 8.85.0.
Original NVD description (English source)
The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'access_privileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This exploit is only possible on installations where an administrator has saved a role-based deny-list Access Privilege configuration that does not explicitly block the internal 'access-privilege' module, as this condition allows the authorization filter to implicitly permit Subscriber-level users to invoke the vulnerable handler.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS