CVE Intelligence
Analysis AI-assisted

CVE-2026-42727: RealMag777 Active Products Tables for WooCommerce

CVE-2026-42727 is an SQL injection flaw (CWE-89) in the Active Products Tables for WooCommerce WordPress plugin by RealMag777, affecting versions up to and including 1.0.8. The record describes it as blind SQL injection and assigns a CVSS 3.1 base score of 9.3 (Critical) from Patchstack. No fixed version is listed and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-42727 is an SQL injection weakness (CWE-89) in the Active Products Tables for WooCommerce WordPress plugin by RealMag777. The record describes it as blind SQL injection and lists versions up to and including 1.0.8. The CVE was published through the Patchstack CNA.

Impact

  • The record reports a CVSS 3.1 base score of 9.3 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L.
  • The vector indicates network access, low complexity, no privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact and low availability impact.
  • SSVC fields in the record indicate the issue is automatable and has partial technical impact.

Affected products and versions

  • RealMag777 Active Products Tables for WooCommerce (identifier profit-products-tables-for-woocommerce), versions ≤ 1.0.8 according to the record.
  • The record lists no fixed version.

Exploitation status

  • The record shows this CVE is not listed in the CISA KEV catalog.
  • No confirmed exploitation appears in the sources consulted.
  • The record's SSVC exploitation value is none and its EPSS probability is 0.004.

Remediation and mitigation

  • Identify whether the plugin is installed and which version is in use; treat version 1.0.8 and earlier as in scope.
  • Because no fixed version is listed, check the Patchstack entry and the plugin vendor for update status. If no fix is available, consider deactivating or removing the plugin until a fix is confirmed.
  • Limit database account privileges used by WordPress to what is strictly needed, and keep WordPress core and other plugins up to date.
  • A web application firewall or similar control may serve as a temporary compensating measure, but it does not replace a vendor fix.

Detection guidance

  • Review web server and application logs for unusual parameter values sent to plugin-related requests, and for database errors or abnormal response times.
  • Monitor database logs for query patterns that originate from the plugin's functionality.

Limitations of the available information

  • The record does not identify the vulnerable parameter, endpoint or authentication context beyond the CVSS vector.
  • No fixed version, vendor advisory text or technical proof details are included.
  • The record contains no separate NVD-assigned score; the listed score comes from the Patchstack CNA.
  • The EPSS date in the record is later than the publication date, so the freshness of that value should be verified.

Frequently asked questions

What is CVE-2026-42727?

It is an SQL injection vulnerability (CWE-89) in the Active Products Tables for WooCommerce WordPress plugin by RealMag777, affecting versions up to and including 1.0.8, described as blind SQL injection.

Is there a fixed version available?

The record does not list a fixed version. This does not prove that no fix exists, so check the Patchstack entry and the vendor for update status.

Is this vulnerability being exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.