JetSmartFilters EUVD-2026-37611

The target site must have the JetSmartFilters plugin installed and active at version 3.8.1 or earlier, and the vulnerable filter endpoint must be reachable over HTTP/HTTPS (default for any public WordPress site using the plugin). No authentication, no user interaction, and no special non-default configuration are required per the CVSS vector (PR:N/UI:N/AC:L). The realistic limiter is plugin presence and version - sites that do not run JetSmartFilters, or that have already updated past 3.8.1, are not exposed; the exact vulnerable parameter and endpoint path are not disclosed in the available intelligence and would need to be confirmed from the Patchstack advisory or vendor changelog.

The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes an unauthenticated, network-reachable, low-complexity attack with no user interaction - the worst-case exposure profile for a WordPress plugin. Scope:Changed with C:H is consistent with reading the full WordPress database (including wp_users password hashes and wp_options secrets), while I:N and A:L suggest the primary risk is data exfiltration rather than direct write/destruction, though chained takeover via password hashes is realistic. EPSS and CISA KEV data were not provided in the input, and no public exploit is identified at time of analysis; however, Patchstack-reported WordPress SQLi flaws in widely deployed plugins historically attract mass scanning quickly. This should be treated as a high real-world priority for any site running JetSmartFilters, despite the absence of confirmed in-the-wild exploitation in the supplied intelligence.

An unauthenticated attacker sends a crafted HTTP request to a public WordPress page that exposes a JetSmartFilters AJAX endpoint, injecting SQL through a vulnerable filter parameter to UNION-select rows from wp_users and exfiltrate administrator password hashes. The hashes are then cracked offline or replayed against other services, and the recovered admin credentials are used to log into wp-admin and install a backdoor plugin. No public PoC has been identified at time of analysis, but exploitation requires only a standard HTTP client.