The vulnerability CVE-2026-42761 exists in the RealMag777 Active Products Tables for WooCommerce plugin (versions up to 1.0.9). It is caused by improper neutralization of special elements in SQL commands, enabling Blind SQL Injection attacks. The CVSS 3.1 score is 9.3 (critical), with an attack vector of network, low attack complexity, no privileges required, no user interaction, and scope changed. The impact is high confidentiality loss and low availability loss, with no integrity impact. No vendor advisory or patch information is available to confirm remediation status.

Successful exploitation allows an unauthenticated attacker to perform Blind SQL Injection, potentially exposing sensitive data from the database (high confidentiality impact). The vulnerability also has a low impact on availability but does not affect data integrity. This could lead to unauthorized data disclosure without requiring user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the affected plugin version to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.