// the find
byteReaper77/CVE-2025-10046
exploit SQL injection ELEX WooCommerce Google Shopping
A proof-of-concept exploit for CVE-2025-10046, a SQL injection vulnerability in the ELEX WooCommerce Google Shopping plugin (≤1.4.3). The vulnerable code passes unsanitized input directly to `$wpdb->query` instead of using prepared statements. Requires authenticated administrator access to trigger.
The README accurately explains why `sanitize_text_field()` is insufficient — it strips HTML but does nothing to prevent SQL injection, which is a genuinely common misunderstanding among WordPress plugin developers. The build instructions are minimal and correct for a C exploit using libcurl and argparse.
Requiring administrator privileges severely limits the real-world impact — an admin can already do arbitrary damage through the WP dashboard without needing SQL injection. The repo has no technical depth beyond the exploit itself: no patch diff, no explanation of how to fix it, no analysis of whether other parameters in the same file are also affected. Six stars and zero forks from a 6-star repo named after a CVE assigned in 2025 with a September 2025 push date raises questions about whether this CVE assignment reflects original research or was filed after a known issue. There is also no disclosure timeline or coordinated response documentation, which is standard practice for CVE authors.