WP Bulk Delete <= 1.4.2 Authenticated SQL Injection via 'delete_user_roles' Parameter (CVE-2026-15727)

Vulnerability Overview Vulnerability Name: WP Bulk Delete <= 1.4.2 - Authenticated (Administrator+) SQL Injection via 'delete_user_roles' Parameter CVE ID: CVE-2026-15727 CVSS Score: 4.9 (Medium) Release Date: July 15, 2026 Last Updated: July 16, 2026 Researchers: PRISM - Wordfence Affected Products Affected Software: WP Bulk Delete Affected Versions: <= 1.4.2 Fixed Version: 1.4.3 Remediation Mitigation: Upgrade to version 1.4.3 or later. Vulnerability Description The WP Bulk Delete plugin contains a generic SQL injection vulnerability in WordPress, present in all versions including 1.4.2, via the 'delete_user_roles' parameter. Due to insufficient escaping of user-supplied parameters and a lack of adequate prepared statements, an attacker can append additional SQL queries to existing SQL queries, thereby extracting sensitive information from the database. References plugins.trac.wordpress.org Additional Information Software Type: Plugin Software Slug: wp-bulk-delete Is Fixed: Yes Fixed Version: 1.4.3 Related Vulnerabilities 1. WP Bulk Delete <= 1.3.6 - Missing Authorization - CVE ID: CVE-2025-58192 - CVSS Score: 4.3 - Researchers: Que Thanh Tuan - Blue Rock - Date: August 27, 2025 2. WP Bulk Delete <= 1.3.1 - Reflected Cross-Site Scripting - CVE ID: CVE-2024-47352 - CVSS Score: 6.1 - Researchers: Dimas Maulana - Date: September 30, 2024 Summary The WP Bulk Delete plugin contains an SQL injection vulnerability in versions 1.4.2 and below. It is recommended to upgrade to version 1.4.3 or later to fix this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

WP Bulk Delete <= 1.4.2 Authenticated SQL Injection via 'delete_user_roles' Parameter (CVE-2026-15727)

More from this source