What is the CVSS score of CVE-2026-42646?

CVE-2026-42646 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of TaxoPress are affected by CVE-2026-42646?

TaxoPress (simple-tags) WordPress plugin versions 3.44.0 and earlier contain a SQL injection vulnerability (CVE-2026-42646) that allows high-privileged administrators to extract sensitive database…

How to fix or mitigate CVE-2026-42646?

Within 24 hours, inventory all WordPress installations using TaxoPress (simple-tags) plugin and document current versions. Within 7 days, either disable and remove the plugin if not operationally essential, or restrict administrative access to this plugin to a minimal set of trusted users and implement database query logging to detect anomalous activity. Within 30 days, monitor Patchstack advisory EUVD-2026-26217 and the WordPress plugin repository for vendor patch release and plan immediate testing and deployment upon availability.

TaxoPress CVE-2026-42646

EUVD-2026-26217 HIGH

SQL Injection (CWE-89)

2026-04-29 Patchstack

WordPress SQLi Taxopress Wordpress Plugin

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.6 HIGH

Requires a high-privileged authenticated account (PR:H) over the network; blind SQLi yields full database read (C:H) reaching beyond the plugin (S:C), with only minor availability and no integrity impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 02:29 vuln.today

EUVD ID Assigned

Apr 29, 2026 - 11:30 euvd

EUVD-2026-26217

CVE Published

Apr 29, 2026 - 10:40 nvd

HIGH 7.6

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Steve Burge TaxoPress simple-tags allows Blind SQL Injection.This issue affects TaxoPress: from n/a through <= 3.44.0.

AnalysisAI

Blind SQL injection in TaxoPress (simple-tags) for WordPress, versions up to and including 3.44.0, lets a high-privileged authenticated user inject SQL through improperly neutralized input (CWE-89) and read arbitrary database contents. Reported by Patchstack (EUVD-2026-26217); there is no public exploit identified at time of analysis and EPSS is very low (0.03%). The CVSS 3.1 base score is 7.6 with a scope change, reflecting that a successful injection reaches the backend database beyond the plugin's own security boundary.

Technical ContextAI

TaxoPress is a WordPress taxonomy, tag, and term management plugin (the legacy 'simple-tags' codebase) that runs inside the WordPress PHP/MySQL stack. The affected component is identified by CPE cpe:2.3:a:steve_burge:taxopress:*:*:*:*:*:*:*:*. The root cause is CWE-89, Improper Neutralization of Special Elements used in an SQL Command: user-controllable input is concatenated into a SQL query without parameterization or proper escaping (WordPress's $wpdb->prepare() or equivalent), allowing an attacker to alter query logic. Because the flaw is blind, no query output is returned directly to the attacker; data is inferred through boolean or time-based response differences, which is slower but still yields full read access to the wp_ database tables.

RemediationAI

Upgrade TaxoPress to the first release after 3.44.0 that addresses this issue; the input data does not include an exact fixed version, so no vendor-released patch version is independently confirmed at time of analysis - consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/simple-tags/vulnerability/wordpress-taxopress-plugin-3-44-0-sql-injection-vulnerability?_s_id=cve) and the plugin changelog for the patched version and update as soon as one is confirmed. Because exploitation requires a high-privileged authenticated account, the strongest compensating control until patched is to tighten role assignments: audit and reduce the number of users holding administrator/elevated roles that can reach TaxoPress admin functions, and remove untrusted accounts (side effect: may disrupt legitimate content editors who rely on tag management). Additionally, place a WAF rule in front of wp-admin to detect SQL injection patterns on the affected plugin endpoints (side effect: possible false positives on legitimate term names containing SQL-like characters), and restrict wp-admin access by IP allowlist where operationally feasible (side effect: breaks remote admin from dynamic IPs).