PT-2026-35905 · WordPress · Taxopress

Timomangcut · Published 2026-04-29 · Updated 2026-04-29 · CVE-2026-42646

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions TaxoPress versions prior to 3.44.1

Description Improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. This occurs within the simple-tags component, where an attacker can send specially crafted SQL queries to the database to retrieve information without the application returning the results directly in the response.

Recommendations Update to a version newer than 3.44.0.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-42646

Affected Products

Taxopress

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-42646 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/simple-tags/vulnerability/wordpress-taxopress-plugin-3-44-0-sql-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2049594378159563189 · Twitter Post