Description

Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-27T10:16:38.267Z",
  "pubdate": "2026-08-27T10:16:38.267Z",
  "executiveSummary": "The Beautiful Taxonomy Filters plugin for WordPress, specifically versions 2.4.6 and below, is susceptible to an unauthenticated SQL injection vulnerability. This flaw arises from improper sanitization and parameterization of user-supplied input before it is incorporated into database queries.\nThe vulnerability allows an unauthenticated remote attacker to manipulate the underlying database structure by injecting malicious SQL commands via the plugin's exposed filter functionality. Successful exploitation can lead to unauthorized data extraction, modification, or deletion, potentially compromising the integrity and confidentiality of the entire WordPress database.\nGiven that this vulnerability does not require authentication, it represents a high-severity risk to affected systems. Attackers can execute these queries without pre-existing privileges, making it an attractive target for automated scanning and mass exploitation efforts. Organizations utilizing this plugin are at risk of complete database exposure, including administrative credentials and sensitive user information.",
  "technicalDetails": "The vulnerability originates from the failure of the Beautiful Taxonomy Filters plugin to sufficiently validate and sanitize user input processed by its query building components. When a user interacts with the filtering interface, the plugin constructs database queries by dynamically concatenating input parameters directly into SQL statements.\nThe root cause is a lack of prepared statements or parameterized queries in the vulnerable code path. By injecting SQL meta-characters and keywords into specific GET or POST parameters—typically those used to filter taxonomy data—an attacker can escape the intended query context. This allows for the injection of arbitrary SQL syntax, such as UNION-based queries, which can be used to bypass filtering logic or extract data from other tables within the WordPress database (e.g., the wp_users or wp_options tables).\nThe attack flow begins with the attacker identifying the target endpoint responsible for processing taxonomy filters. The attacker then crafts a malicious payload containing SQL injection sequences and sends the request to the server without needing authentication or active session cookies. Because the plugin does not verify the requester's authority or sanitize the input, the database engine executes the injected SQL commands in the context of the current database user.\nThe impact of this post-exploitation scenario is significant. An attacker can leverage UNION-based SQL injection to systematically exfiltrate the contents of sensitive database tables. Furthermore, depending on the database configuration and permissions, an attacker might be able to perform blind SQL injection to infer data byte-by-byte if error messages are suppressed. In environments where the database user has elevated privileges (such as FILE or administrative permissions), the impact could extend to reading server-side files or writing malicious content, potentially leading to full system compromise or remote code execution via the injection of web shells into the web directory.\nThis vulnerability affects all versions of Beautiful Taxonomy Filters up to and including 2.4.6. The exposure is global, as the affected code is reachable through standard public-facing web requests, and no specific user role is required to trigger the vulnerable code execution path."
}