What is the CVSS score of CVE-2026-54836?

CVE-2026-54836 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of YMC Filter are affected by CVE-2026-54836?

The YMC Smart Filter WordPress plugin (all versions through 3.11.5) contains a critical SQL injection vulnerability accessible to unauthenticated remote attackers, enabling direct database access and…

Is there a public PoC exploit available for CVE-2026-54836?

Yes, a public proof-of-concept exploit is available for CVE-2026-54836. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-54836?

Within 24 hours: Disable the YMC Smart Filter plugin across all WordPress installations and document affected sites. Within 7 days: Deploy Web Application Firewall (WAF) rules blocking common SQL injection payloads (UNION SELECT, comment sequences, time-based injection patterns); enable database transaction logging. Within 30 days: Either migrate to an alternative filter solution with confirmed security patches, remove the plugin if not critical to operations, or maintain disabled status until vendor releases patched version 3.11.6 or later.

YMC Filter CVE-2026-54836

EUVD-2026-39389 CRITICAL

SQL Injection (CWE-89)

2026-06-25 Patchstack

GHSA-9mfm-rqgg-86f7

WordPress SQLi Wordpress Plugin Ymc Filter

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Unauthenticated, network-reachable SQLi with low complexity (AV:N/AC:L/PR:N/UI:N); injection reaches the shared DB backend (S:C), primarily enabling data read (C:H) with limited availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:25 vuln.today

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows SQL Injection.

This issue affects YMC Filter: from n/a through 3.11.5.

AnalysisAI

SQL injection in the YMC Filter (YMC Smart Filter / Filter Grids) WordPress plugin lets remote attackers inject malicious SQL through unsanitized input, affecting all versions up to and including 3.11.5. Per the CVSS vector (PR:N), exploitation is unauthenticated and network-reachable, enabling database content disclosure and a scope change beyond the plugin's own data. No public exploit identified at time of analysis, and no EPSS score was supplied, so real-world exploitation prevalence is currently unmeasured.

Technical ContextAI

The flaw is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), the root-cause class where user-supplied input is concatenated into a database query without parameterization or proper escaping. The affected component is the YMC Filter plugin for WordPress (CPE cpe:2.3:a:ymc:ymc_filter), a front-end content filtering/grid plugin that queries the WordPress MySQL/MariaDB backend. Because WordPress plugins typically execute queries through the global $wpdb layer, an injectable parameter that bypasses $wpdb->prepare() or sanitization functions (e.g. sanitize_text_field, absint) allows attacker-controlled SQL to reach the database engine.

RemediationAI

No vendor-released patch version is identified in the available data (the advisory lists affected versions up to 3.11.5 without a confirmed fixed release), so monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/ymc-smart-filter/vulnerability/wordpress-filter-grids-plugin-3-11-5-sql-injection-vulnerability and the plugin's WordPress.org page for an update beyond 3.11.5 and apply it immediately when published. As compensating controls until a patch exists: deploy a WordPress-aware WAF (such as Patchstack or Wordfence) with SQL-injection rules to filter the vulnerable plugin endpoints, which adds latency and may need tuning to avoid false positives; if the smart-filter/grid functionality is non-essential, deactivate and remove the plugin entirely, which removes the front-end filtering feature; and restrict database privileges of the WordPress DB user to the minimum required, limiting the blast radius of any successful injection at the cost of breaking plugins that expect broader grants.