What is the CVSS score of CVE-2026-66436?

CVE-2026-66436 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Active Products Tables for WooCommerce are affected by CVE-2026-66436?

The realmag777 'Active Products Tables for WooCommerce' plugin (versions ≤1.1.1) exposes WooCommerce database contents through unauthenticated SQL injection, allowing attackers to access customer…

How to fix or mitigate CVE-2026-66436?

Within 24 hours: Audit all WordPress instances to identify if the realmag777 plugin version 1.1.1 or earlier is installed; immediately disable and deactivate the plugin across all environments. Within 7 days: Review database access logs for unauthorized SQL queries or anomalous activity; assume potential compromise and preserve forensic evidence for investigation; notify affected customers per applicable regulations (GDPR, CCPA, etc.) if customer or payment records may have been exposed. Within 30 days: Identify and deploy a patched alternative plugin or migrate to a different solution for product table functionality; complete forensic analysis to determine if the vulnerability was exploited; implement database activity monitoring and deploy Web Application Firewall (WAF) rules to detect and block SQL injection attempts.

Active Products Tables for WooCommerce CVE-2026-66436

EUVD-2026-57866 CRITICAL

SQL Injection (CWE-89)

2026-08-13 Patchstack

GHSA-xcp8-6575-98fc

WordPress SQLi Active Products Tables For Woocommerce Wordpress Plugin Realmag777

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.5 HIGH

Unauthenticated network SQLi gives AV:N/AC:L/PR:N/UI:N with C:H for database read; I:N and A:N reflect a read-only/blind injection, and S:U as impact stays within the site DB.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:38 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

CRITICAL 9.3

DescriptionCVE.org

Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions.

Articles & Coverage 1

News Critical SQL Injection in Active Products Tables for WooCommerce Plugin - CVE-2026-66436 Aug 14, 2026

AnalysisAI

SQL injection in the realmag777 'Active Products Tables for WooCommerce' WordPress plugin (versions up to and including 1.1.1) lets remote attackers inject arbitrary SQL against the site database without authentication. Reported by Patchstack and rated CVSS 9.3 (CWE-89), the flaw exposes back-end WooCommerce/WordPress data to disclosure. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

The affected component is a WooCommerce add-on plugin (CPE cpe:2.3:a:realmag777:active_products_tables_for_woocommerce) that renders product data in table views on WordPress storefronts. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input - typically a request parameter used to filter, sort, or query the product table - is concatenated into a SQL statement without proper parameterization or sanitization, allowing the attacker's input to alter query structure. Because WordPress plugins execute against the shared site database (wp_ tables plus WooCommerce order/customer data), a successful injection reaches sensitive commerce data. The exact vulnerable parameter is not disclosed in the available data.

RemediationAI

Upgrade the plugin to a fixed release above 1.1.1 as provided by the vendor; a specific patched version number is not stated in the available data, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/profit-products-tables-for-woocommerce/vulnerability/wordpress-active-products-tables-for-woocommerce-plugin-1-1-1-sql-injection-vulnerability) and the plugin's WordPress.org page for the current fixed version. If no fixed version is yet available or you cannot upgrade immediately, deactivate and remove the plugin (its table-rendering feature will be lost from storefront pages), or place a Web Application Firewall / Patchstack virtual patch in front of the site to block SQL injection patterns on the plugin's request parameters - WAF rules can cause false positives on legitimate filtered queries, so monitor after deployment. Additionally restrict database user privileges for the WordPress DB account to the minimum required to limit the blast radius of any read-based injection.