rootpwn

critical · CVSS v3 8.8 · EPSS 0.0037

CVE-2026-18443

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to a generic SQL injection via

Overview

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to a generic SQL injection via the 'access_privileges' parameter. This flaw allows authenticated users with subscriber-level access to inject SQL and extract sensitive data. The vulnerability exists in all versions up to 8.97.0.

Description

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'access_privileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This exploit is only possible on installations where an administrator has saved a role-based deny-list Access Privilege configuration that does not explicitly block the internal 'access-privilege' module, as this condition allows the authorization filter to implicitly permit Subscriber-level users to invoke the vulnerable handler.

Impact

Confidentiality: attackers can read database contents. Integrity: potential for data manipulation. Availability: not directly affected. Impacted parties: WordPress site owners, administrators, and any users with subscriber-level access.

Remediation

Upgrade to version 8.97.1 or later where the 'access_privileges' parameter is properly sanitized. If upgrade is not possible, restrict subscriber-level users from accessing the bulk edit interface or disable the plugin. Apply a web application firewall rule to block suspicious SQL patterns on the 'access_privileges' parameter.

Risk context

Severity is critical with CVSS 8.8 and EPSS 0.0037, indicating a low probability but high impact. Defenders should treat this as a high-priority issue and address it promptly.

Affected products

  • Smart Manager plugin
  • WordPress

Scores

Severity
critical
CVSS v2
9
CVSS v3
8.8
CVSS v4
—
EPSS
0.0037

SQL Injection WordPress Plugin Vulnerability Access Control Data Exfiltration Critical

← All CVEs

Related CVEs

critical

CVE-2026-105134

A critical OS command injection flaw exists in Ahsay AhsayCBS 10.3.2 and earlier, triggered via the random parameter in /rps/api/json/UpdateReceivers.do. Attackers can execute arbitrary commands remotely without authentication. The vulnerability is publicly exploited and can compromise system integrity and availability.

View analysis

critical

CVE-2026-105123

A critical remote code execution flaw exists in Vincent Peugnet's WCMS (v3.18.0) that lets authenticated editors upload arbitrary files via the media upload API. The vulnerability allows path traversal to write files outside the media directory and delete arbitrary files, enabling execution of malicious PHP code. This flaw can be exploited by anyone with editor credentials to compromise the web server.

View analysis

critical

CVE-2026-88779

Citrix NetScaler ADC and Gateway are affected by a critical vulnerability that could allow attackers to compromise the confidentiality, integrity, and availability of network traffic and services. The flaw exists in versions prior to 14.1-73.41 and 13.1-64.28 for ADC, and similar pre‑release versions for Gateway. It is exploitable by remote actors with network access.

View analysis

critical

CVE-2026-105135

InternLM MindSearch 0.1.0 is vulnerable to remote code injection via the Planner Agent's ExecutionAction.run function. The flaw allows attackers to execute arbitrary code on the host. This can compromise confidentiality, integrity, and availability of affected systems.

View analysis