Executive brief
WPBulky is a WordPress plugin for bulk editing posts and content types. The plugin contains a SQL injection vulnerability in the contributor role that allows attackers with contributor-level access to execute arbitrary database queries, potentially exposing, modifying, or deleting all user accounts, posts, and sensitive data stored in the WordPress database.
Technical details
The vulnerability is a SQL injection flaw (CWE-89) in WPBulky versions 1.2.2 and earlier, requiring contributor-level privileges to exploit. The root cause appears to be insufficient input sanitization in the bulk editing functionality. An authenticated attacker with contributor role can craft malicious SQL queries through the plugin's interface to read, modify, or delete database records. The attack vector is network-based but requires valid WordPress contributor credentials. A patch was released in version 1.2.3.
Affected products
- VillaTheme WPBulky 1.2.2 and earlier
Timeline
- 2026-08-25: disclosed: Reported by JunHee CHO
- 2026-08-28: advisory: Published by Patchstack
- 2026-08-28: patched: Version 1.2.3 available as patch