EUVD-2026-39370
GHSA-x48r-vwgp-xc93
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running MDTF ≤1.3.7
-
DeliverySend crafted filter HTTP request
-
ExploitInject SQL via filter parameter
-
ExecutionDatabase executes attacker query
-
ImpactExfiltrate credentials and sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target WordPress site has the MDTF (Meta Data Filter & Taxonomy Filter) plugin version 1.3.7 or earlier installed and active, with at least one front-end filter endpoint reachable over the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no special conditions - remote unauthenticated exploitation is possible against default configurations once the plugin is present, with no authentication and no user interaction needed. The principal limiting factor is simply deployment of this specific plugin within the vulnerable version range; the exact injectable parameter is not specified in the available data and should be confirmed from the vendor advisory. |
| Impact | The supplied signals are partly consistent and partly thin: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated attack, which is the worst-case profile for a SQLi and aligns with the 9.3 score. However, the vector lists C:H/I:N/A:L with a changed scope (S:C); the I:N is notable because many SQL injections also permit data modification, and the S:C plus A:L combination is a Patchstack scoring convention rather than something independently verifiable from the description. No EPSS score, no KEV status, and no POC indicator were provided, so real-world exploitation likelihood cannot be quantified - the high CVSS is a theoretical-severity signal, not evidence of active attacks. Net: treat as a genuine high-priority web vulnerability because unauthenticated SQLi against a public-facing CMS plugin is readily weaponizable, but note the absence of exploitation telemetry and verify the exact injectable parameter and impact (read vs. write) against the vendor advisory. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a public page that invokes the MDTF filter, injecting malicious SQL into a vulnerable filter parameter to extract sensitive data such as user credentials or session/option secrets from the WordPress database. Given AV:N and AC:L, this can be automated at scale against any internet-exposed site running MDTF; no public exploit code has been identified at time of analysis, but unauthenticated SQLi of this class is straightforward to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 25, 2026
SQL injection in the WordPress "Meta Data Filter & Taxonomy Filter" (MDTF) plugin by pluginus.net affects all versions up to and including 1.3.7, allowing remote attackers to inject arbitrary SQL into backend queries without authentication. Per the provided CVSS vector (PR:N), exploitation requires no login, and the high CVSS base score of 9.3 reflects network reachability plus a scope change. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS data supplied, so prioritization rests on the CVSS signal alone.
RemediationAI
No vendor-released patch version was identified in the available data, so confirm the latest release on the plugin page and upgrade to any version newer than 1.3.7 as soon as the vendor publishes a fix (consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-meta-data-filter-and-taxonomy-filter/vulnerability/wordpress-mdtf-plugin-1-3-7-sql-injection-vulnerability?_s_id=cve for fix tracking). Until a fixed version is confirmed, the most effective compensating control is to deactivate and remove the MDTF plugin, which eliminates the attack surface at the cost of losing the meta/taxonomy filtering feature on the site. If the plugin must stay live, deploy a WAF rule (e.g., Patchstack vPatch or an equivalent virtual patch) to block SQL metacharacters and injection patterns on the plugin's filter request parameters - noting this can cause false positives on legitimate filter queries - and restrict or rate-limit access to the affected front-end filter endpoints while monitoring database error logs for injection attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the MDTF (Meta Data Filter and Taxonomy Filter) WordPress plugin, identified by the CPE cpe:2.3:a:pluginus.net:mdtf:*:*:*:*:*:*:*:*, which provides front-end product/post filtering by custom fields, meta data, and taxonomies. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input - typically filter parameters passed to the plugin's query-building logic - is concatenated into a SQL statement without proper parameterization or sanitization. Because WordPress plugins query the shared site database via wpdb, a successful injection can reach core tables such as wp_users and wp_options.
Know when Mdtf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SQLi (AV:N/AC:L/PR:N/UI:N) primarily enables database read (C:H); I/A left N absent evidence of write/DoS, and S:U since impact stays within the same database authority.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated SQL Injection in MDTF <= 1.3.7 versions.
Executive ViewAI
The WordPress "Meta Data Filter & Taxonomy Filter" plugin (versions ≤1.3.7) contains an unauthenticated SQL injection vulnerability (CVSS 9.3) that allows attackers to directly query or manipulate the website's database without login credentials. Any organization running this plugin on production WordPress sites faces immediate risk of data exfiltration, modification, or deletion. Affected sites must be identified and remediated within 24 hours.
If immediate removal is not feasible: (1) Deploy WAF rules blocking SQL injection syntax on the plugin's entry points; (2) restrict database user account to minimum required privileges and enable detailed query logging for forensic detection; (3) implement network segmentation to limit database access; (4) daily vulnerability scanning of database for signs of tampering. None of these mitigations eliminate the vulnerability-removal or patching remains mandatory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Unauthenticated local file inclusion in the WordPress 'Meta Data and Taxonomy Filter' (MDTF) plugin by pluginus.net affe
A DOM-Based Cross-Site Scripting (XSS) vulnerability exists in the RealMag777 MDTF (Meta Data Filter and Taxonomy Filter
Stored cross-site scripting in the MDTF (Meta Data Filter & Taxonomy Filter) WordPress plugin, versions through 1.4.0, l
Exploit-DB