The ELEX WooCommerce Google Shopping (Google Product Feed) plugin for WordPress is vulnerable to SQL Injection via the 'file_to_delete' parameter in all versions up to, and including, 1.4.3 due insufficient escaping on user supplied lack of sufficient preparation existing query. This makes it possible authenticated attackers, with Administrator-level access above, append additional queries into already that can be used extract sensitive information from database.