What is the CVSS score of CVE-2026-42761?

CVE-2026-42761 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Active Products Tables are affected by CVE-2026-42761?

The RealMag777 'Active Products Tables for WooCommerce' plugin (versions ≤1.0.9) contains a critical SQL injection vulnerability enabling unauthenticated attackers to directly access and extract…

How to fix or mitigate CVE-2026-42761?

Within 24 hours: Identify all WordPress instances using RealMag777 'Active Products Tables for WooCommerce' plugin (all versions through 1.0.9); immediately disable and remove the plugin. If product table functionality is business-critical, temporarily implement Web Application Firewall rules to block SQL injection patterns. Within 7 days: Audit database access logs and query history for indicators of unauthorized access; coordinate with database teams to implement minimum-privilege account restrictions and enhanced monitoring. Within 30 days: Deploy an alternative WooCommerce product table plugin with active security maintenance; conduct full database integrity audit and establish continuous database query monitoring.

Active Products Tables CVE-2026-42761

EUVD-2026-32210 CRITICAL

SQL Injection (CWE-89)

2026-05-27 audit@patchstack.com

GHSA-8c6j-mwqr-7247

SQLi WordPress

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 19:45 vuln.today

CVE Published

May 27, 2026 - 11:16 nvd

CRITICAL 9.3

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Blind SQL Injection.This issue affects Active Products Tables for WooCommerce: from n/a through <= 1.0.9.

AnalysisAI

Blind SQL injection in the RealMag777 "Active Products Tables for WooCommerce" WordPress plugin (all versions up to and including 1.0.9) allows remote unauthenticated attackers to inject SQL into backend database queries and infer sensitive data through boolean or time-based responses. The CVSS 3.1 vector (PR:N/UI:N) indicates exploitation requires no authentication or user interaction, and the changed scope (S:C) reflects that compromise of the WordPress database can affect the entire site beyond the plugin itself. There is no public exploit identified at time of analysis, and no KEV listing or EPSS score was provided.

Technical ContextAI

The affected component is a WordPress plugin that renders product tables for WooCommerce stores, implemented in PHP and backed by the site's MySQL/MariaDB database (typically accessed through WordPress's $wpdb abstraction layer). The root cause is CWE-89, Improper Neutralization of Special Elements used in an SQL Command: untrusted input is concatenated into a database query without proper parameterization or sanitization. Because the flaw manifests as 'blind' SQL injection, query results are not returned directly in the response; instead an attacker infers data by observing differences in application behavior (boolean responses) or response timing. No CPE strings were supplied in the input, so exact affected configuration identifiers cannot be enumerated beyond the vendor/plugin name and version range.

RemediationAI

No vendor-released patch version was identified in the provided data, so the exact fixed release cannot be cited; administrators should consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/profit-products-tables-for-woocommerce/vulnerability/wordpress-active-products-tables-for-woocommerce-plugin-1-0-9-sql-injection-vulnerability?_s_id=cve) and upgrade to a fixed version above 1.0.9 as soon as one is published, then verify the running version in the WordPress plugins page. Until a patched build is confirmed, the most effective compensating control is to deactivate and remove the plugin entirely (trade-off: product table functionality is lost on the storefront). If the plugin must stay active, deploy a WordPress-aware WAF with virtual-patching/SQLi rules (Patchstack, Wordfence, or equivalent) to filter malicious query patterns reaching the plugin's endpoints, and restrict access to the affected request paths where feasible - noting that WAF rules can be bypassed and may produce false positives. As defense in depth specific to data confidentiality, ensure database credentials are least-privilege and rotate any secrets stored in the database if compromise is suspected.