EUVD-2026-39370
GHSA-x48r-vwgp-xc93
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SQLi (AV:N/AC:L/PR:N/UI:N) primarily enables database read (C:H); I/A left N absent evidence of write/DoS, and S:U since impact stays within the same database authority.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated SQL Injection in MDTF <= 1.3.7 versions.
AnalysisAI
SQL injection in the WordPress "Meta Data Filter & Taxonomy Filter" (MDTF) plugin by pluginus.net affects all versions up to and including 1.3.7, allowing remote attackers to inject arbitrary SQL into backend queries without authentication. Per the provided CVSS vector (PR:N), exploitation requires no login, and the high CVSS base score of 9.3 reflects network reachability plus a scope change. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS data supplied, so prioritization rests on the CVSS signal alone.
Technical ContextAI
The affected component is the MDTF (Meta Data Filter and Taxonomy Filter) WordPress plugin, identified by the CPE cpe:2.3:a:pluginus.net:mdtf:*:*:*:*:*:*:*:*, which provides front-end product/post filtering by custom fields, meta data, and taxonomies. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input - typically filter parameters passed to the plugin's query-building logic - is concatenated into a SQL statement without proper parameterization or sanitization. Because WordPress plugins query the shared site database via wpdb, a successful injection can reach core tables such as wp_users and wp_options.
RemediationAI
No vendor-released patch version was identified in the available data, so confirm the latest release on the plugin page and upgrade to any version newer than 1.3.7 as soon as the vendor publishes a fix (consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-meta-data-filter-and-taxonomy-filter/vulnerability/wordpress-mdtf-plugin-1-3-7-sql-injection-vulnerability?_s_id=cve for fix tracking). Until a fixed version is confirmed, the most effective compensating control is to deactivate and remove the MDTF plugin, which eliminates the attack surface at the cost of losing the meta/taxonomy filtering feature on the site. If the plugin must stay live, deploy a WAF rule (e.g., Patchstack vPatch or an equivalent virtual patch) to block SQL metacharacters and injection patterns on the plugin's filter request parameters - noting this can cause false positives on legitimate filter queries - and restrict or rate-limit access to the affected front-end filter endpoints while monitoring database error logs for injection attempts.
Unauthenticated local file inclusion in the WordPress 'Meta Data and Taxonomy Filter' (MDTF) plugin by pluginus.net affe
A DOM-Based Cross-Site Scripting (XSS) vulnerability exists in the RealMag777 MDTF (Meta Data Filter and Taxonomy Filter
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today