CVE-2026-54836: WordPress Filter & Grids plugin <= 3.11.5 - SQL Injection vulnerability

Synopsis

SQL injection in the YMC Filter and Grids WordPress plugin (versions up to and including 3.11.5) is reachable over the network with no authentication required. An attacker sends a crafted HTTP request to a WordPress site running the plugin, injecting arbitrary SQL into the underlying database query. Successful exploitation reads sensitive data from the database and can cause limited service disruption. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The plugin endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the target WordPress site.

• AuthenticationNot required

  No account or session token is needed; the vulnerable parameter is accessible to unauthenticated HTTP requests.

• Victim interactionNot required

  The attacker sends a direct request to the server; no user action or social engineering is involved.

• Attack complexityDetail

  Exploitation is reliable and condition-free: no race conditions, memory layout knowledge, or special environmental factors are required.

Blast Radius

• Reads arbitrary database content, including WordPress user credentials (hashed passwords), email addresses, session tokens, and any stored customer or post data.
• Crosses the security boundary of the WordPress installation (Scope: Changed), meaning data from other applications sharing the same database server can be reached if the database user has broader permissions.
• Causes limited availability disruption through malformed or expensive queries that degrade database performance or produce errors visible to legitimate users.