CVE-2026-42727

Vulnerability

Improper neutralization of special elements in SQL commands in the Active Products Tables for WooCommerce plugin (profit-products-tables-for-woocommerce) for WordPress allows blind SQL injection. Versions from n/a through 1.0.8 are affected. [1]

Exploitation

An attacker can exploit the vulnerability without authentication by sending crafted HTTP requests to the WordPress site. The blind SQL injection technique allows extracting information from the database by observing responses. No user interaction is required. [1]

Impact

Successful exploitation grants the attacker direct access to the database, enabling theft of sensitive data such as user credentials and other stored information. This can lead to complete compromise of the WordPress site. The CVSS score is 9.3 (Critical). [1]

Mitigation

Update the plugin to version 1.0.9 or later, which contains the fix. Patchstack also provides a mitigation rule to block attacks until the update is applied. If unable to update immediately, contact your hosting provider or web developer for assistance. [1]