The Active Products Tables for WooCommerce plugin (all versions up to 1.0.6.7) contains an input validation flaw (CWE-20) in the get_smth() function. This flaw permits unauthenticated attackers to invoke arbitrary WordPress filters with a single parameter due to insufficient restriction checks. The vulnerability has a CVSS 3.1 base score of 7.3, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Exploitation of this vulnerability allows unauthenticated attackers to call arbitrary WordPress filters, potentially leading to partial disclosure of information, modification of data, or disruption of service within the affected WordPress environment. The CVSS vector indicates that the attack can be performed remotely without authentication or user interaction, increasing the risk of exploitation. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently available, users should monitor for updates from the plugin vendor realmag777. Until a fix is released, consider disabling or removing the plugin if it is not critical to operations, or restrict access to the WordPress installation to trusted users only.