What is the CVSS score of CVE-2026-42727?

CVE-2026-42727 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Active Products Tables are affected by CVE-2026-42727?

The RealMag777 WooCommerce product table plugin (versions ≤1.0.8) contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to extract customer data, transaction…

How to fix or mitigate CVE-2026-42727?

Within 24 hours: Inventory all WordPress installations with RealMag777 'Active Products Tables for WooCommerce' plugin version 1.0.8 or earlier; disable the plugin immediately; review application and database access logs for suspicious SQL queries and failed authentication attempts. Within 7 days: Conduct forensic analysis of database audit logs to identify unauthorized data access or exfiltration; quantify scope of customer and payment data potentially exposed; determine if breach notification obligations triggered. Within 30 days: Deploy Web Application Firewall rules blocking SQL injection patterns in HTTP traffic; identify and test vetted alternative WooCommerce product table plugins; apply vendor security patch immediately upon release.

Active Products Tables CVE-2026-42727

EUVD-2026-32181 CRITICAL

SQL Injection (CWE-89)

2026-05-27 audit@patchstack.com

GHSA-vf5w-c836-hrfj

SQLi WordPress

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 19:46 vuln.today

CVE Published

May 27, 2026 - 11:16 nvd

CRITICAL 9.3

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Blind SQL Injection.This issue affects Active Products Tables for WooCommerce: from n/a through <= 1.0.8.

AnalysisAI

Blind SQL injection in the RealMag777 'Active Products Tables for WooCommerce' WordPress plugin (versions up to and including 1.0.8) lets remote attackers inject SQL commands via an unsanitized parameter to read arbitrary data from the WordPress/WooCommerce database. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with a changed scope, meaning the injection reaches the backend database beyond the plugin component itself. There is no public exploit identified at time of analysis and no EPSS score was provided, so probability of exploitation cannot be quantified from the available data.

Technical ContextAI

The flaw is a CWE-89 SQL Injection: user-controlled input is concatenated into an SQL query without proper neutralization of special elements. This is a WordPress plugin extending WooCommerce (the dominant e-commerce platform for WordPress) to render product tables; the plugin slug is profit-products-tables-for-woocommerce. Because the injection is 'blind,' the application does not return query results or verbose errors directly, so an attacker infers data one piece at a time using boolean-based or time-based techniques against the underlying database (typically MySQL/MariaDB behind WordPress). No CPE strings were supplied in the input, so affected components are identified from the vendor advisory and version string rather than NVD CPE configurations.

RemediationAI

No vendor-released patch version is identified in the available data, so the exact fixed release cannot be cited; administrators should monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/profit-products-tables-for-woocommerce/vulnerability/wordpress-active-products-tables-for-woocommerce-plugin-1-0-8-sql-injection-vulnerability?_s_id=cve) and the plugin changelog and upgrade to the first release above 1.0.8 as soon as it is published. Until a fix is available, the highest-assurance control is to deactivate and remove the plugin, with the trade-off of losing the product-table feature on storefront pages. If the plugin must remain active, deploy a WAF or WordPress security plugin with SQL-injection signatures and Patchstack virtual-patching rules in front of the site (trade-off: signature rules may be bypassable and can produce false positives), and restrict access to the affected store pages to trusted networks where the table feature is internal-only (trade-off: breaks public storefront use). Apply least-privilege to the WordPress database account to limit what a successful blind extraction can reach.