CVE-2026-78288: Beautiful Taxonomy Filters SQLi Vulnerability

CVE-2026-78288 Overview

CVE-2026-78288 is an unauthenticated SQL Injection vulnerability in the Beautiful Taxonomy Filters WordPress plugin, affecting all versions up to and including 2.4.6. The flaw is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Attackers can exploit the vulnerability remotely without authentication or user interaction. Successful exploitation allows extraction of sensitive database content and can affect the availability of the WordPress backend.

Critical Impact
Remote, unauthenticated attackers can inject arbitrary SQL statements into the WordPress database, exposing user credentials, session data, and site configuration.

Affected Products

Beautiful Taxonomy Filters plugin for WordPress, versions <= 2.4.6
WordPress sites with the plugin installed and active
Any hosting environment exposing the affected plugin endpoints to untrusted networks

Discovery Timeline

2026-08-27 - CVE-2026-78288 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78288

Vulnerability Analysis

The vulnerability is an unauthenticated SQL injection reachable through the plugin's request handling logic. User-supplied input is passed into a SQL query without proper sanitization or parameterization.

Because exploitation requires no authentication and no user interaction, any attacker able to reach the target WordPress site can trigger the flaw. The CVSS scope is marked as changed, indicating that a compromised database context can affect resources beyond the vulnerable component.

Confidentiality impact is high, meaning attackers can read sensitive data such as WordPress user credentials, password hashes, and session tokens. Availability is also affected because malicious queries can degrade or disrupt database operations.

Refer to the Patchstack SQL Injection Advisory for the vendor-specific technical breakdown.

Root Cause

The root cause is the direct concatenation of untrusted request parameters into SQL statements executed against the WordPress database. The plugin does not use $wpdb->prepare() or equivalent parameter binding for the vulnerable code path. Input validation and escaping routines are either missing or applied inconsistently before the query is executed.

Attack Vector

The attack vector is network-based over HTTP or HTTPS against a WordPress site running the vulnerable plugin. An attacker submits crafted parameters to an endpoint exposed by Beautiful Taxonomy Filters. The injected payload alters the SQL query structure, enabling data extraction through UNION-based, boolean-based, or time-based blind SQLi techniques.

No verified proof-of-concept code is published in the referenced advisory, so exploitation details are described in prose only. See the Patchstack SQL Injection Advisory for additional context.

Detection Methods for CVE-2026-78288

Indicators of Compromise

HTTP requests to Beautiful Taxonomy Filters endpoints containing SQL metacharacters such as ', ", --, UNION, SELECT, or SLEEP(
Unusual spikes in wpdb query errors or MySQL slow-query log entries tied to plugin parameters
Outbound connections from the web server to attacker infrastructure shortly after suspicious query strings appear in access logs
Unexpected reads against the wp_users or wp_usermeta tables from the plugin's request context

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL injection payloads targeting WordPress query parameters used by taxonomy filters
Enable MySQL general query logging on a sampled basis and correlate query patterns with plugin URLs
Alert on HTTP 500 responses or database errors returned from plugin endpoints, which often accompany injection probing
Baseline normal request parameter values for the plugin and identify statistical outliers in length or character composition

Monitoring Recommendations

Forward WordPress access logs, PHP error logs, and MySQL error logs to a centralized logging platform for correlation
Monitor authentication events in wp_users for unexpected password hash changes or new administrative accounts
Track file integrity of WordPress core, wp-config.php, and plugin directories to detect post-exploitation persistence

How to Mitigate CVE-2026-78288

Immediate Actions Required

Update the Beautiful Taxonomy Filters plugin to a version newer than 2.4.6 as soon as a fixed release is available from the vendor
If no patched version is available, deactivate and remove the plugin from all affected WordPress installations
Rotate WordPress administrator passwords, API keys, and secret salts in wp-config.php on any site suspected of exposure
Review the wp_users table for unauthorized accounts and audit recent database backups for signs of data exfiltration

Patch Information

At the time of NVD publication on 2026-08-27, the referenced Patchstack SQL Injection Advisory identifies all versions <= 2.4.6 as vulnerable. Confirm the fixed release directly with the plugin author or through the WordPress plugin repository before deploying to production.

Workarounds

Restrict access to the WordPress site with an authenticating reverse proxy or IP allow-list while a patch is pending
Enable a WAF ruleset that blocks common SQL injection patterns against plugin request parameters
Apply virtual patching through Patchstack or an equivalent WordPress-focused protection service
Disable the plugin's public-facing filter endpoints in the theme or template until remediation is complete

bash

# Configuration example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate beautiful-taxonomy-filters --allow-root
wp plugin delete beautiful-taxonomy-filters --allow-root

# Rotate WordPress salts after suspected exposure
wp config shuffle-salts --allow-root