EUVD-2026-101524
GHSA-8qx6-ggx9-2j4r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach plugin endpoint over network
-
DeliverySubmit crafted filter/taxonomy parameter
-
ExploitTrigger code injection in MDTF (CWE-94)
-
ExecutionExecute injected code in WordPress context
-
ImpactCompromise site data or server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The MDTF plugin (wp-meta-data-filter-and-taxonomy-filter) must be installed and active at version 1.3.9 or earlier. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required, so exploitation works against a default install reachable over the network. The description does not name a specific feature, configuration setting, or deployment mode as a precondition, so the primary limiting factor is simply the presence of the vulnerable plugin version; the exact injectable parameter/endpoint is not specified in the available data and should be confirmed from the Patchstack advisory. |
| Impact | Signals are thin and internally inconsistent, which caps confidence. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated issue, but its impact metrics (C:L/I:N/A:N, score 5.3) are strikingly LOW for a CWE-94 'Code Injection' flaw tagged 'RCE' - genuine arbitrary code execution normally warrants C:H/I:H/A:H. This is a direct conflict: either the Patchstack impact scoring is conservative/understated, or the 'RCE' tag overstates a more limited code-injection primitive. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: treat as a potentially serious unauthenticated code-injection bug in a WordPress plugin, but the true impact must be verified against the Patchstack advisory before prioritizing - do not rely on the 5.3 base score alone given the CWE-94/RCE conflict. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to a WordPress site running MDTF ≤1.3.9, injecting code through a filter/taxonomy parameter the plugin passes to a dynamic code-execution sink. If the 'RCE' characterization holds, this yields arbitrary PHP execution in the site context; if the vendor's C:L scoring is accurate, impact may be limited to partial information disclosure. No public proof-of-concept was provided in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Unauthenticated remote code execution is possible in the WordPress plugin MDTF (wp-meta-data-filter-and-taxonomy-filter) through version 1.3.9, which carries a CWE-94 code injection flaw in PluginUs.Net's metadata/taxonomy filtering component. Per the CVSS vector (PR:N/UI:N) no credentials or user interaction are required, so any site running the vulnerable release with the plugin active is exposed; the NVD score of 5.3 (C:L/I:N/A:N) is materially lower than the assessed C:H/I:H/A:H, and no public exploit code and no CISA KEV listing were identified at time of analysis. Confidence is capped because the signals are thin and internally inconsistent - the unresolved CVSS disagreement and the absence of any named injectable parameter, function, or endpoint mean the minimal precondition confirmed so far is simply the presence of the vulnerable plugin version.
RemediationAI
No vendor-released patch was identified in the available data, so the first step is to consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-meta-data-filter-and-taxonomy-filter/vulnerability/wordpress-mdtf-plugin-1-3-9-arbitrary-code-execution-vulnerability) for a fixed MDTF version above 1.3.9 and upgrade only to that confirmed release, since 1.3.9 and earlier remain in the affected range. If the plugin is not essential, deactivate and remove it - the trade-off is loss of its metadata and taxonomy filtering functionality on the site, but it eliminates the exposure entirely rather than mitigating it. Where the plugin must remain active, apply virtual patching at the WAF or reverse-proxy layer to block code-injection payloads aimed at MDTF's filtering parameters and restrict access to the plugin's AJAX/REST endpoints, accepting that the PR:N/UI:N vector means an internet-reachable endpoint stays the primary risk and WAF signatures can be evaded with encoding tricks. Supplementary controls include enforcing least privilege so no WordPress role holds unnecessary file-write or plugin-editor capability (this limits post-exploitation escalation but not the initial injection), enabling file-integrity monitoring to catch unexpected PHP additions under wp-content/plugins/, and keeping WordPress core, themes, and remaining plugins fully patched. Per the available data, the patch status is: no vendor-released patch identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-94 (Improper Control of Generation of Code) describes a class of bug in which an application assembles executable code from externally influenced data without adequate sanitization or validation, allowing attacker input to be interpreted as code rather than data. In this case the affected component is the WordPress plugin MDTF (slug wp-meta-data-filter-and-taxonomy-filter) from PluginUs.Net, whose metadata and taxonomy filtering logic builds dynamic code paths; the Patchstack advisory title ('arbitrary code execution vulnerability') and the WordPress/RCE/Code Injection tags corroborate that the outcome is code execution rather than mere data disclosure. Scope per ENISA EUVD-2026-101524 is MDTF versions from n/a through 1.3.9; no CPE strings were supplied, so the affected product is identified by its WordPress plugin slug rather than a formal CPE entry, and detection must rely on the installed plugin version string. The provided data does not identify the specific injectable parameter, AJAX action, or REST route, and the two severity assessments conflict sharply (NVD 5.3 with C:L/I:N/A:N versus the independent C:H/I:H/A:H), which is why the exploit path cannot be narrowed further than 'plugin installed, active, and network-reachable' and should be confirmed directly against the Patchstack advisory before relying on either score.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-94 code injection reachable unauthenticated over the network (AV:N/AC:L/PR:N/UI:N) implies arbitrary code execution, so C/I/A:H; this intentionally diverges from the input's understated C:L/I:N/A:N.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
DescriptionCVE.org
Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Code Injection.This issue affects MDTF: from n/a through 1.3.9.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB