Active Products Tables for WooCommerce CVE-2026-66436

Exploitation requires that the 'Active Products Tables for WooCommerce' plugin (version ≤ 1.1.1) be installed and active on a network-reachable WordPress/WooCommerce site, with the vulnerable product-table query endpoint exposed to unauthenticated requests. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), there are no special conditions - remote unauthenticated exploitation is possible against default configurations of the plugin, with no authentication, no user interaction, and low attack complexity. The principal limiting factor is simply whether this specific niche plugin is installed; sites not running it (or already upgraded past 1.1.1) are not exposed.

The signals point to a genuine high priority rather than an inflated score: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated, no-interaction exploitation, which is the profile most likely to be mass-scanned and automated against WordPress. The vendor set scope changed (S:C) with C:H/I:N/A:L, indicating primary impact is confidentiality (database read) with limited availability effect and no direct integrity change. Counterbalancing this, no EPSS score was provided, there is no POC or KEV entry, and no evidence of active exploitation, so the realistic near-term threat is opportunistic scanning of exposed stores rather than confirmed campaigns; even a mid-sized operator running this plugin on a public storefront should treat it as urgent and patch on a short timeline. One caveat to verify: SQLi commonly enables at least read-level confidentiality impact, and the vendor's I:N (no integrity impact) suggests a read-only/blind injection - teams should confirm with Patchstack whether write or stacked-query capability exists, as that would raise the impact.

An attacker discovers a WooCommerce store running the plugin and sends a crafted, unauthenticated HTTP request to the endpoint or parameter that builds the product-table query, injecting SQL to extract data such as user credentials, session tokens, or customer/order records from the WordPress and WooCommerce tables. Because no authentication or user interaction is required and complexity is low, the attack is easily scripted and scannable at scale, though no public POC has been identified at time of analysis.