Beautiful Taxonomy Filters
Monthly
SQL injection in the Beautiful Taxonomy Filters WordPress plugin (versions 2.4.6 and earlier) lets remote, unauthenticated attackers inject arbitrary SQL through the plugin's taxonomy filtering logic, exposing the entire WordPress database including credentials and secrets. Rated CVSS 9.3 with a network attack vector and no privileges required, though no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. The scope-changed CVSS vector signals impact reaching beyond the plugin into the shared database backing the whole site.
SQL injection in the Beautiful Taxonomy Filters WordPress plugin (versions 2.4.6 and earlier) lets remote, unauthenticated attackers inject arbitrary SQL through the plugin's taxonomy filtering logic, exposing the entire WordPress database including credentials and secrets. Rated CVSS 9.3 with a network attack vector and no privileges required, though no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. The scope-changed CVSS vector signals impact reaching beyond the plugin into the shared database backing the whole site.