This vulnerability (CVE-2026-66436) concerns improper neutralization of special elements used in SQL commands (CWE-89) in the Active Products Tables for WooCommerce plugin by RealMag777. It allows unauthenticated attackers to perform SQL Injection attacks on versions up to 1.1.1, enabling them to access or manipulate sensitive data. The CVSS v3.1 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No patch or official remediation is currently documented.

The vulnerability enables unauthenticated remote attackers to execute arbitrary SQL commands, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). The integrity of data is not impacted according to the CVSS vector. This poses a critical risk to affected WooCommerce installations using the vulnerable plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.