CVE-2026-78288: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Jonathan de Jong Beautiful Taxonomy Filters

CVE-2026-78288 is an SQL Injection vulnerability (CWE-89) in Jonathan de Jong's Beautiful Taxonomy Filters plugin, affecting all versions up to and including 2.4.6. The vulnerability allows unauthenticated attackers to inject malicious SQL commands remotely, resulting in a critical severity with a CVSS 3.1 base score of 9.3. The attack vector is network-based with low attack complexity and no privileges or user interaction required. The impact includes complete confidentiality compromise and limited availability impact. No known exploits in the wild have been reported, and no official patch or remediation level has been published as of the current data.

The vulnerability allows unauthenticated remote attackers to perform SQL Injection attacks, which can lead to unauthorized disclosure of sensitive data (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. This could compromise the database underlying the affected plugin, exposing sensitive information to attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting this plugin. Monitor for updates from the vendor or trusted security sources for an official patch.