Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-10046: ELEX WooCommerce Google Shopping Plugin SQL Injection Risk: Unauthorized Data Access

CVE-2025-10046 · published 1 year ago

Summary

The ELEX WooCommerce Google Shopping plugin for WordPress is vulnerable to a security risk that could allow an attacker with Admin access to view sensitive database information. This means an attacker could potentially see confidential data, like passwords or user details. To protect your site, update the plugin to the latest version (1.4.4 and above) as soon as possible.

Original advisory text

The ELEX WooCommerce Google Shopping (Google Product Feed) plugin for WordPress is vulnerable to SQL Injection via the 'file_to_delete' parameter in all versions up to, and including, 1.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.9 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published6 Sep 2025

Updated31 Oct 2026

First seen7 Mar 2026

Sources

CVE-2025-10046 · NVD

Track software like this

Free during beta