External risk intelligence

Unauthenticated SQL Injection in MDTF Plugin

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-54843

This vulnerability affects a WordPress plugin, which are commonly deployed as part of public-facing web applications. SQL injection vulnerabilities in such plugins are typically reachable via web requests from the internet.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a component that processes metadata and taxonomies, specifically impacting unauthenticated SQL injection. This issue could allow unauthorized access to sensitive information, raising concerns about data integrity and potential misuse. The primary focus for leadership is to understand the potential relevance of this component within the organization's technology landscape and confirm any exposure.

Unauthenticated SQL injection vulnerability exists.
Matters due to potential data access and misuse.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can target this vulnerability by sending specially crafted network requests to an application that uses the affected software. Since no authentication is required, this could allow an attacker to inject malicious SQL commands into the application's database, potentially leading to unauthorized data access or modification.

Unauthenticated network access required.
Triggered via crafted database queries.
Risk of unauthorized data exposure.

Live Threat

Current exploitation, exposure, and threat context

This unauthenticated SQL injection vulnerability could allow an attacker to access, modify, or delete sensitive data within the application's database when supported by the advisory. The vulnerability is reachable over the network without authentication and can impact system data and potentially service behavior.

Database records.
Network requests targeting the application.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-World Ownership

Identifying and addressing this unauthenticated SQL injection vulnerability requires collaboration. Application owners are primarily responsible for the affected plugin, but infrastructure and platform teams may need to support remediation efforts. Network and security teams should also be involved to assess external exposure. The immediate first step is to locate all instances of the affected plugin, determine their reachability and criticality, and then assign ownership to initiate a coordinated response.

Application owners are responsible.
Verify plugin reachability and criticality.
Plan coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the MDTF plugin?

MDTF (Meta Data and Taxonomy Filter) is a WordPress plugin used to help users organize and search through complex product data, posts, or custom taxonomies. It functions as an add-on within a WordPress site to improve navigation by allowing visitors to filter content based on specific metadata parameters.

What does SQL injection mean for CVE-2026-54843?

This CVE involves a weakness classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. In plain terms, the plugin fails to properly sanitize user input, allowing an attacker to inject their own malicious database commands. This can trick the application into revealing sensitive information stored in the database that should otherwise remain hidden.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specially crafted network requests directly to the web application where the plugin is active. No login or administrative privileges are needed to initiate the attack. Crucially, simply browsing the site or interacting with standard, non-malicious filter options does not trigger the vulnerability; it requires a request specifically designed to manipulate the underlying database query.

Is my site at risk from this CVE?

According to Halo Surface Signal, this vulnerability is considered likely to be reachable from the internet. Because it affects a WordPress plugin, sites that use MDTF for public-facing search or filtering features are typically exposed to network-based attacks. If your instance is only available on an internal network, the risk profile changes, though the vulnerability itself remains inherent to the plugin code.

What should I do if I use the MDTF plugin?

Your first step is to perform an inventory to locate all active installations of the MDTF plugin across your WordPress environments. Once identified, confirm which sites are internet-facing to prioritize them. Coordinate with your application owners to evaluate the plugin's necessity and monitor for official updates or patches that resolve the underlying SQL injection flaw.

References

patchstack.com/database/wordpress/plugin/wp-meta-data-filter-and-tax…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.