Smart Manager
Smart Manager provides spreadsheet-style management for WooCommerce products, orders, customers, and store data.
Smart Manager (smart-manager-for-wp-e-commerce) is a WordPress plugin with 5 published CVE records in this archive. The latest tracked vulnerability was published Oct 03, 2026; the highest published CVSS base score is 8.8.
smart-manager-for-wp-e-commerceCVE-2026-18443: Smart Manager: Conditional Subscriber SQL injection in access privileges
The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'access_privileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This exploit is only possible on installations where an administrator has saved a role-based deny-list Access Privilege configuration that does not explicitly block the internal 'access-privilege' module, as this condition allows the authorization filter to implicitly permit Subscriber-level users to invoke the vulnerable handler. The official changelog confirms the fixed release as 8.98.0.
| Safe version |
|
||
|---|---|---|---|
| Oct 03, 2026 |
CVE-2026-18443
Smart Manager: Conditional Subscriber SQL injection in access privileges
The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'access_privileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This exploit is only possible on installations where an administrator has saved a role-based deny-list Access Privilege configuration that does not explicitly block the internal 'access-privilege' module, as this condition allows the authorization filter to implicitly permit Subscriber-level users to invoke the vulnerable handler. The official changelog confirms the fixed release as 8.98.0.
|
8.98.0 |
CVE8.8
|
| Jul 23, 2026 |
CVE-2026-57704
Smart Manager: Cross-site scripting
Smart Manager is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 8.90.0.
|
8.91.0 |
CVE7.1
|
| May 25, 2026 |
CVE-2026-45216
Smart Manager: Privilege escalation or authentication bypass
Smart Manager is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess. The published affected range is n/a through 8.85.0.
|
8.86.0 |
CVE8.8
|
| Jan 21, 2025 |
CVE-2025-22710
Smart Manager: SQL injection
Smart Manager is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE7.6
|
| Dec 31, 2024 |
CVE-2024-49687
Smart Manager: A security weakness
Smart Manager is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
|