SQL Injection in Smart Manager for WooCommerce

The Smart Manager for WooCommerce plugin (versions 8.97.0 and below) contains a critical SQL injection vulnerability identified as CVE-2026-18443. The flaw exists due to inadequate input sanitization and lack of parameterized queries within the 'access_privileges' parameter handling logic. Attackers with at least subscriber-level access can manipulate database queries to exfiltrate sensitive information. This exploitation vector is specifically viable on installations where an administrator has configured a role-based deny-list for Access Privileges but failed to explicitly exclude the internal 'access-privilege' module. Because of this oversight, the authorization filter erroneously permits lower-privileged users to invoke the vulnerable handler, enabling unauthorized database interaction.

Impact

Successful exploitation allows authenticated attackers with subscriber-level access to execute arbitrary SQL commands against the underlying WordPress database. This can lead to the unauthorized extraction of sensitive business data, customer information, or administrative credentials stored within the WooCommerce environment. The vulnerability impacts all WordPress installations running the affected plugin versions where specific, non-restrictive access configurations are present.

Recommendation

• Upgrade the 'Smart Manager - Advanced WooCommerce Bulk Edit & Inventory Management' plugin to the latest version (above 8.97.0) immediately.
• Review role-based Access Privilege configurations in the Smart Manager dashboard to ensure the 'access-privilege' module is explicitly restricted for all non-administrative user roles.
• Audit database access logs and monitor for anomalous SQL syntax errors or query patterns originating from subscriber-level user sessions.