Unauthenticated SQL Injection in Beautiful Taxonomy Filters by WordPress
CVE-2026-78288

9.3CRITICAL

Key Information:

Vendor

WordPress
Status
Beautiful Taxonomy Filters
Vendor
CVE Published:
27 August 2026

What is CVE-2026-78288?

The Beautiful Taxonomy Filters plugin for WordPress versions up to 2.4.6 is susceptible to an unauthenticated SQL injection vulnerability. This allows attackers to execute arbitrary SQL queries, potentially compromising the database. Websites using affected versions are at risk of data exposure or manipulation, making it critical for site administrators to update immediately.

Affected Version(s)

Beautiful Taxonomy Filters <= 2.4.6

References

https://patchstack.com/database/wordpress/plugin/beautifu...
vdb-entry

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

JunHee CHO | Patchstack Bug Bounty Program
.