bytereaper77/cve-2025-10046exploit SQL injection ELEX WooCommerce Google Shopping
Author: Byte Reaper
CVE-2025-10046 is a SQL injection vulnerability in the ELEX WooCommerce Google Shopping (Product Feed) plugin for WordPress, versions 1.4.3 and earlier. The issue resides in the includes/elex-manage-feed-ajax.php file, where the file_to_delete parameter is not properly sanitized before being used in SQL queries.
Attack vector: Authenticated (Administrator)
Impact: An attacker with administrator privileges could inject arbitrary SQL statements, potentially leading to database information disclosure or tampering.
Severity: High (Requires administrator privileges, but may compromise database integrity).
Linux x86_64
GCC
This image shows the code area in the elex-manage-feed-ajax.php file that is vulnerable to SQL injection. The sanitize_text_field() function is applied first to sanitize user input from suspicious HTML tags and ensure proper Unicode formatting, but this is not sufficient to prevent SQL injection. Next, a global object is used to access the table, and the code calls directly without using properly prepared statements or other validation methods. The SQL statement executes user input on the database, and since is not strictly validated, this allows SQL injection to be effective.
$wpdbgpf_feeds$wpdb->queryDELETE FROM $table_name WHERE feed_id= $idfile_to_deletegcc exploit.c argparse.c -o CVE-2025-10046 -lcurl
./CVE-2025-10046 -u http://127.0.0.1 -v -c [Cookie file admin]
MIT