Beautiful Taxonomy Filters CVE-2026-78288

The only prerequisite is that a target WordPress site has the Beautiful Taxonomy Filters plugin (version <= 2.4.6) installed and active, with its filter endpoint reachable over the network; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, no user interaction, and no special non-default configuration required - this is unauthenticated, remote, low-complexity exploitation against a default install of the plugin. The practical limiting factor is deployment scope: exploitation is impossible unless this specific, relatively niche plugin is installed, so the flaw is not broadly applicable across arbitrary WordPress sites. The exact vulnerable parameter/endpoint is not enumerated in the provided data.

The signals point to a genuinely high-priority, easy-to-exploit flaw rather than an inflated CVSS: the vector is AV:N/AC:L/PR:N/UI:N - network-reachable, low complexity, unauthenticated, and no user interaction - which is the classic profile of a mass-scannable WordPress plugin bug, and any mid-sized operator running this plugin should treat it as urgent. Confidence-limiting caveats: it is NOT in CISA KEV and no POC is referenced, so there is no confirmed active exploitation; EPSS was not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The supplied vector's impact mix is notable - C:H but I:N and only A:L - indicating a data-disclosure-centric injection rather than one asserted to modify data, and the S:C (scope change) rating should be verified against the actual injection sink, since a straightforward read-only SQLi within one database is often scored S:U. Net assessment: real and actionable priority for anyone running the plugin, but exploitation is currently theoretical/POC-absent, likely opportunistic if a public exploit emerges given Patchstack disclosure.

An attacker crawls the internet for WordPress sites exposing Beautiful Taxonomy Filters, then sends a single crafted HTTP request with a malicious taxonomy/term filter parameter carrying an SQL payload. Because no authentication or user interaction is required (PR:N/UI:N), the injected query executes against the site database, letting the attacker dump wp_users password hashes and secret keys. No public exploit code is referenced in the source data, so this scenario is currently derived from the CVSS vector and CWE-89 classification rather than an observed exploit.