Executive brief
WP Bulk Delete is a WordPress plugin used by site administrators to delete large amounts of content or users at once. A security flaw allows an attacker with administrative access to run unauthorized database commands. This could lead to the theft of sensitive information from the website's database, though it requires the attacker to already have high-level access to the site.
Technical details
The WP Bulk Delete plugin for WordPress is vulnerable to SQL Injection via the 'delete_user_roles' parameter in versions up to 1.4.2. The vulnerability stems from the application of wp_unslash() to the raw POST body before it is processed by parse_str(), which removes WordPress's built-in magic-quotes protection. Consequently, user-supplied input reaches the SQL sink without sufficient escaping or preparation. An authenticated attacker with administrator-level privileges can exploit this to append additional SQL queries and extract sensitive information from the database. A patch appears to be available in the trunk/latest versions following version 1.4.2.
Affected products
- Xylus WP Bulk Delete up to, and including, 1.4.2
Timeline
- 2026-07-16: disclosed
- 2026-07-16: advisory
References
- https://plugins.trac.wordpress.org/browser/wp-bulk-delete/tags/1.4.1/includes/ajax-delete-handler.php
- https://plugins.trac.wordpress.org/browser/wp-bulk-delete/tags/1.4.1/includes/ajax-delete-handler.php
- https://plugins.trac.wordpress.org/browser/wp-bulk-delete/tags/1.4.1/includes/class-delete-api.php
- https://plugins.trac.wordpress.org/browser/wp-bulk-delete/tags/1.4.1/includes/class-delete-api.php
- https://plugins.trac.wordpress.org/browser/wp-bulk-delete/tags/1.4.2/includes/ajax-delete-handler.php
- https://plugins.trac.wordpress.org/browser/wp-bulk-delete/tags/1.4.2/includes/ajax-delete-handler.php
- https://plugins.trac.wordpress.org/browser/wp-bulk-delete/tags/1.4.2/includes/class-delete-api.php