External risk intelligence

Beautiful Taxonomy Filters SQL Injection <= 2.4.6

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-78288

The vulnerability affects a WordPress plugin, which functions as a web application component. These components are typically deployed as part of public-facing websites, making them reachable via the internet as part of the standard web application stack.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability found in the Beautiful Taxonomy Filters WordPress plugin. The flaw allows for unauthenticated SQL injection, meaning an attacker could potentially access or manipulate database information without needing any login credentials. The primary concern is to determine if this specific plugin is in use and, if so, to what extent it may be exposed to potential risks.

  • Unauthenticated database access is possible.
  • Affects a popular website component.
  • Confirm usage; assess relevance and exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending a specially crafted request to a website that uses the Beautiful Taxonomy Filters plugin. This request targets a weakness in how the plugin handles user input, allowing the attacker to inject malicious SQL commands. Successful exploitation could lead to unauthorized access to sensitive data or disruption of database operations.

  • No authentication required.
  • User input in taxonomy filters.
  • Sensitive data exposure and denial of service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious SQL code into the application, potentially leading to unauthorized access or modification of database content when the "Beautiful Taxonomy Filters" plugin is used.

  • Database content.
  • Via unauthenticated SQL injection.
  • Unauthorized access to information.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in Beautiful Taxonomy Filters affects WordPress plugins, likely managed by application owners or platform teams. The initial step is to identify all instances of this plugin, determine their internet reachability and business criticality, and pinpoint the accountable owner for each. Subsequent actions will depend on this assessment, prioritizing remediation for the most exposed and critical systems.

  • Application owners must identify plugin instances.
  • Verify external reachability and business impact.
  • Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Beautiful Taxonomy Filters plugin?

Beautiful Taxonomy Filters is a WordPress plugin designed to help site administrators create complex filtering systems for taxonomies, tags, or categories. It simplifies how visitors navigate large content collections on WordPress websites by adding structured search and filtering interfaces to the front end of a site.

What does CWE-89 SQL injection mean for CVE-2026-78288?

This vulnerability is classified as CWE-89, which refers to improper neutralization of special elements used in an SQL command. In the context of CVE-2026-78288, the plugin fails to properly clean user-provided data before including it in database queries. This allows unauthorized parties to manipulate those queries, potentially letting them read or interfere with the information stored in the underlying database.

How does an attacker trigger this SQL injection?

An attacker triggers this flaw by sending a specially crafted HTTP request to a site running the affected plugin. Because the vulnerability is unauthenticated, no login or administrative access is required to initiate the attack. Normal interactions with the plugin that do not involve submitting input to the vulnerable filter parameters will not trigger this specific issue.

Why does Halo Surface Signal categorize this as an external risk?

Halo Surface Signal flags this as an external risk because the plugin functions as a web application component. Since these components are typically integrated into the public-facing pages of a website to serve visitors, they are directly reachable via the internet as part of the standard web application stack, increasing the potential for remote access.

Do I need to take immediate action if I run this plugin?

Yes. First, you should identify all WordPress sites in your environment where Beautiful Taxonomy Filters is installed. Once you have an inventory, evaluate which instances are exposed to the internet and determine their business criticality. Use this information to prioritize which sites require urgent attention, such as disabling the plugin or seeking an update if available.

References

Sources and related resources

Primary sources: NVD, CVE.org.

NVDPublished