CVE-2023-52215 is a critical severity (9.3) SQL injection in the Barcode Scanner and Inventory Manager (Simple Inventory Management) WordPress plugin, affecting version 1.5.1 and earlier. The developer fixed it in version 1.5.2. Update the plugin to 1.5.2 or later, and if you cannot update, deactivate it until you can.
What's affected
The NVD record names UkrSolution and the Barcode Scanner and Inventory Manager (Simple Inventory Management) plugin for WordPress, from the earliest release through 1.5.1. Patchstack lists 1.5.2 as the patched version. Upgrade to 1.5.2 or any later release.
The weakness is CWE-89, SQL injection. The record's CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, which gives 9.3 (Critical).
Patchstack lists the required privilege as unauthenticated. No login is needed. The NVD record names the plugin Simple Inventory Management, for WooCommerce, and its CPE uses the name Barcode Scanner and Inventory Manager. Patchstack titles it Barcode Scanner with Inventory and Order Manager. These are the same product.
How to check if you're exposed
Start with the plugin list. On a server with WP-CLI, run this from the site folder:
wp plugin list
wp plugin get barcode-scanner-lite-pos-to-manage-products-inventory-and-orders
The first command shows every installed plugin with its version and status. The second shows the details of this one. If the slug is not found, the plugin is not installed under that folder name.
Without shell access, open Plugins, Installed Plugins in the admin and read the version under the plugin name. On WordPress multisite, check the network plugin list and each site, since a plugin can be active on only some of them.
A version at or below 1.5.1 is in the affected range. An inactive plugin is lower risk than an active one, but it is still on disk, so remove it if it is unused.
What to do now
- Open the Plugins screen, or run the WP-CLI check above, and note the installed version.
- Update Barcode Scanner and Inventory Manager (Simple Inventory Management) to 1.5.2 or later on staging first if you test changes, then on production.
- If the update cannot go out today, deactivate the plugin. A deactivated plugin does not run its code.
- Review recent activity: check web server logs for unusual requests to the plugin and look for unexpected new administrator accounts or changed orders.
- Add the plugin to whatever tracks your WordPress inventory, so the next advisory finds it quickly.
Why it matters
SQL injection happens when a value from a request is placed into a database query without being separated from the query itself. The database then cannot tell data from instructions. The standard defence is a prepared statement, where the query text and the values travel separately.
Patchstack describes the outcome as the ability to read, modify or delete the whole database, including user accounts and private data. Because no login is needed here, anyone who can reach the site can try it, which is why the score is in the critical range. Stores that keep customer and order data in the same database should treat any suspected exposure as a data incident. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and the sources I read do not report exploitation in the wild. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan and the Gold directory help you track which components you run and which advisories apply.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does CVE-2023-52215 need a login?
No. The vector has no privileges required and Patchstack lists the privilege as unauthenticated. Anyone who can reach the site could attempt it.
Is there a patched version?
Yes. Patchstack lists 1.5.2 as the patched release for versions up to 1.5.1. Check the plugin's own changelog before you upgrade.
Sources
Last reviewed: 19 October 2026.
