External risk intelligence

Active Products Tables for WooCommerce SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-66436

This vulnerability exists in a WordPress plugin designed for WooCommerce, which is fundamentally a public-facing web storefront. Plugins that handle product tables are accessed by web users browsing the site, making the vulnerable code directly reachable via the public internet as part of the normal web application surface.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves an unauthenticated SQL injection flaw within WooCommerce product tables, potentially allowing unauthorized access to sensitive data. It is a critical issue impacting public-facing online stores.

Unauthenticated data access risk in product tables.
Critical flaw affects public online storefronts.
Confirm relevance and identify affected systems.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted requests over the internet to a WooCommerce site running a vulnerable version of the Active Products Tables plugin. This could lead to unauthorized access to sensitive database information, as the plugin does not properly sanitize user input before including it in SQL queries.

No authentication required.
Triggered by sending SQL injection payload.
Risk of sensitive data exposure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious SQL commands into the active products tables. This might occur when the application processes product data without properly sanitizing user input. The potential impact includes unauthorized access to database information and service disruption.

Database information could be exposed.
Unauthenticated SQL injection may occur.
Unauthorized access and service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in a WooCommerce plugin impacts customer-facing websites, suggesting platform or application teams managing the e-commerce site are primarily responsible. The immediate priority is to locate all instances of the affected plugin, assess their exposure and criticality, and identify the accountable system owner to plan a targeted remediation strategy.

Platform and application teams own remediation.
Verify plugin presence and business criticality.
Plan targeted risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Active Products Tables for WooCommerce plugin?

This software is a WordPress plugin used by online stores to organize and display product catalogs. It enhances WooCommerce by allowing site administrators to present complex item listings, search filters, and table layouts that customers interact with while browsing products on an e-commerce website.

What does SQL injection mean for CVE-2026-66436?

This vulnerability is classified as CWE-89, which occurs when software fails to properly clean data provided by users before using it in database queries. In this case, an attacker can insert malicious commands into these queries to trick the database into revealing information it should keep private.

How does an attacker trigger this vulnerability?

The flaw is triggered when an attacker sends a specially crafted request to the web server that includes malicious SQL code. Notably, this does not require a user to log in or hold special permissions on the site; simply interacting with the plugin's functionality via the internet is enough to initiate the attack.

Is my website at risk from this vulnerability?

According to Halo Surface Signal, this vulnerability is particularly relevant because the affected plugin is part of a public-facing web storefront. Because these product tables are designed to be viewed by customers online, the vulnerable code is directly reachable by anyone browsing the internet, making it highly accessible to potential attackers.

What should I do if I use this plugin?

You should immediately inventory your WordPress sites to identify if the Active Products Tables for WooCommerce plugin is installed and active. Once located, verify the version number to confirm if it falls within the affected range, and coordinate with your site administrators to apply the necessary updates or mitigate the risk to your database.

References

patchstack.com/database/wordpress/plugin/profit-products-tables-for-…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.