The vulnerability CVE-2026-42646 in Steve Burge TaxoPress plugin (simple-tags) is caused by improper neutralization of special elements in SQL commands, resulting in a blind SQL injection vulnerability. This affects all versions up to and including 3.44.0. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No official remediation or patch is currently documented, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker with high privileges to perform blind SQL injection attacks, potentially leading to unauthorized disclosure of sensitive data. Integrity of data is not impacted, and availability impact is low. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the affected plugin features to trusted administrators and monitor for suspicious activity. Avoid exposing the vulnerable component to untrusted users. Apply vendor patches promptly once available.