CVE Intelligence
Analysis AI-assisted

CVE-2026-54836: YMC Filter - SQL Injection

CVE-2026-54836 is a critical SQL injection vulnerability in YMC Filter, reported by Patchstack with a CVSS 3.1 base score of 9.3. The record places affected versions at n/a through 3.11.5 but lists no structured fixed version. The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-54836 is an SQL injection flaw (CWE-89) reported by Patchstack in YMC Filter. The record describes affected versions as n/a through 3.11.5 and rates the issue critical with a CVSS 3.1 base score of 9.3. The reference path points to a WordPress plugin, which suggests the product is a WordPress extension, although the record does not state this explicitly. See the Patchstack record for the vendor-independent database entry.

Impact

SQL injection allows input to alter database queries built by the application. The CVSS 3.1 vector in the record indicates a network attack vector, no privileges required, no user interaction, high confidentiality impact, no integrity impact, low availability impact and a changed scope.

  • Confidentiality: rated high, so data stored in the connected database may be exposed.
  • Integrity: rated none in the vector.
  • Availability: rated low.

Actual consequences depend on database permissions and application configuration, which the record does not describe.

Affected products and versions

  • Product: YMC Filter, as named in the record.
  • Affected range: n/a through 3.11.5. The lower bound is not specified.
  • Fixed version: none listed in the record. The absence of a fixed version does not establish that no fix exists, so its status is unknown.

The record contains no structured list of affected products.

Exploitation status

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and no EPSS data is available. No confirmed exploitation appears in the sources consulted for this analysis.

Remediation and mitigation

  • Identify whether YMC Filter is installed and which version is in use, especially any version at or below 3.11.5.
  • Check the Patchstack record and the vendor for an updated release, and apply it once a fixed version is confirmed.
  • If no fixed version is available, consider disabling the component or restricting access to the affected functionality until official guidance is published.
  • Apply least-privilege principles to the database account used by the application.
  • Use web application filtering as a temporary compensating control, recognising that it does not replace a fix.

Detection guidance

  • Review web server and application logs for unusual or malformed parameter values directed at filter functionality.
  • Look for database errors or unexpected query behaviour reported by the application.
  • Monitor for unexpected data access patterns on the database.

Limitations of the available information

  • The record has no title and no structured affected or fixed version data.
  • The source status is Deferred.
  • No EPSS or SSVC data is present.
  • Product identity comes from the description and a reference path, which may use different names.
  • Attack prerequisites beyond the CVSS vector are not described.

Frequently asked questions

Is CVE-2026-54836 being actively exploited?

This CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. Monitoring advisories remains advisable.

Which YMC Filter versions are affected?

The record states affected versions run from n/a through 3.11.5. The lower bound is not specified, and no fixed version is listed in the record.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.