YMC Filter EUVD-2026-39389

Exploitation requires the YMC Filter (YMC Smart Filter / Filter Grids) plugin, version 3.11.5 or earlier, to be installed and active on a network-reachable WordPress site. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required, so exploitation works against default configurations once the plugin is enabled - the only gating factor is the presence of the plugin's filtering feature exposing the injectable parameter. The limiting factor is therefore deployment scope: sites that do not run this specific plugin are unaffected, and the exact injectable endpoint/parameter is not detailed in the available data and must be confirmed against the Patchstack advisory.

The CVSS 3.1 base score is 9.3 (critical) driven by AV:N (network), AC:L (low complexity), PR:N (no privileges), UI:N (no user interaction) and S:C (scope change), with C:H confidentiality, I:N integrity and A:L availability impact. This signals an easily reachable, unauthenticated injection - a genuine priority for any site running the plugin. However, several corroborating signals are missing: no EPSS score was provided to gauge exploitation probability, the vulnerability is NOT on the CISA KEV list (no confirmed active exploitation), and no SSVC decision data was supplied. The integrity impact is rated N and availability only L, suggesting the assessed primary risk is data exfiltration (read) rather than full database takeover - note this is somewhat atypical for unauthenticated SQLi, which often permits writes, so verify the exact injectable sink with the vendor. Net: high latent severity with low-to-moderate confirmed real-world urgency pending EPSS/exploitation data.

An unauthenticated attacker identifies a site running YMC Filter ≤3.11.5 and sends a crafted HTTP request to the plugin's filter/grid endpoint with a malicious value in an injectable parameter (e.g. a filter, taxonomy, or AJAX argument). The injected SQL is executed against the WordPress database, allowing the attacker to extract sensitive data such as user records and password hashes. No public proof-of-concept is identified at time of analysis, but the low attack complexity (AC:L) and lack of authentication make exploitation straightforward once the parameter is located.