CVE-2026-54836: SQL Injection in YMC Filter

Affected Versions and Fixed Version

The affected product is the YMC Filter WordPress plugin, also associated with the WordPress.org slug ymc-smart-filter. The available evidence confirms that versions through 3.11.5 are affected. Because the NVD wording is “from n/a through 3.11.5,” defenders should interpret that as 3.11.5 and earlier rather than a narrow subrange.

The important limitation is that the fixed version number is not confirmed from the source material available in this research pass. The NVD record did not expose a fixed release, the available Patchstack reference confirms the vulnerability context but did not provide a reliably extracted remediation version in-session, and the WordPress.org plugin page could not be used to verify changelog details due to an HTTP 429 response during collection. In the absence of a confirmed fixed version, defenders should assume one of two things: either a post-3.11.5 release contains the fix, or no fix has yet been clearly validated. Operationally, that means you should update to the newest available release immediately, then verify changelog, vendor advisory, or plugin diff before considering the issue closed.

Exploitation Status, PoC Status, and Urgency

At the time of this writing, exploitation in the wild is not confirmed from the sources used for this article. Specifically, this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, which means there is no CISA-confirmed evidence of active exploitation from KEV as of 2026-06-25. That is useful context, but it should not be interpreted as low risk. KEV absence is not proof of safety; it only means public federal confirmation is not present there.

Likewise, a public proof of concept is not confirmed from the material retrieved for this research pass. No GitHub exploit, vendor write-up with weaponized details, or secondary reference was verified from the NVD-linked source set. Because neither active exploitation nor PoC availability is confirmed, defenders should be careful with messaging: do not claim “actively exploited” or “public exploit available.” At the same time, do not delay remediation simply because those fields are unknown. A critical SQL injection in a WordPress plugin often attracts rapid analysis after disclosure, so the prudent assumption is that exploitability may become easier over time.

What Defenders Should Do Now

First, determine whether the plugin is installed anywhere in your environment. For WordPress estates that include many sites, start with asset inventory and plugin enumeration rather than waiting for web logs or endpoint alerts to reveal exposure. Any site running YMC Filter version 3.11.5 or earlier should be considered vulnerable until a verified fixed version is identified and deployed.

Second, treat internet-facing WordPress systems as the highest priority. If the vulnerable code path is reachable without authentication, exposure could be immediate; if authentication is required, risk may still be meaningful in multi-user publishing environments, partner portals, or any site with untrusted contributor accounts. Because the authentication requirement is unknown from current evidence, defenders should assume the most conservative case during triage and prioritize public-facing sites first.

Technical Notes

You can quickly identify the plugin and its version on a host by checking the plugin directory and the main plugin file header:

grep -R "Version:" /var/www/html/wp-content/plugins/ymc-smart-filter -n

If you manage WordPress with WP-CLI, enumerate plugin status and versions:

wp plugin list --path=/var/www/html | grep ymc-smart-filter

If a newer release exists in the WordPress repository, update directly with WP-CLI:

wp plugin update ymc-smart-filter --path=/var/www/html

If you need to reduce exposure before a validated fix is confirmed, deactivate the plugin:

wp plugin deactivate ymc-smart-filter --path=/var/www/html

Technical Impact and Assumptions

The confirmed vulnerability class is SQL injection, but several important exploit details remain unknown from the evidence used here. Those unknowns include the exact vulnerable parameter, whether the bug is authenticated or unauthenticated, whether exploitation is blind or error-based, and the precise impact on confidentiality, integrity, and availability in a default deployment. It is important not to overstate those details without source-backed confirmation.

Still, defenders should assume that successful exploitation could allow unauthorized database reads and, depending on query context, data modification. In a WordPress environment that may include disclosure of usernames, email addresses, password hashes, post data, plugin settings, and potentially security plugin configuration. If you discover suspicious requests matching SQLi patterns against a vulnerable host, consider a broader incident review: check for unauthorized admin creation, plugin/theme changes, content tampering, and unusual outbound connections.

Technical Notes

If compromise is suspected, review recent administrative changes:

wp user list --role=administrator --path=/var/www/html
wp plugin list --status=active --path=/var/www/html
wp option get siteurl --path=/var/www/html

Query WordPress users directly for timeline analysis:

SELECT ID, user_login, user_email, user_registered
FROM wp_users
ORDER BY user_registered DESC;

Bottom Line

CVE-2026-54836 is a critical SQL injection vulnerability affecting the YMC Filter WordPress plugin through version 3.11.5. A fixed version number is not yet confirmed from the source material available for this article, and neither active exploitation nor a public PoC is confirmed at this time. That uncertainty should not slow response. If you run the plugin, identify exposed instances now, update to the latest release, verify whether that release contains the fix, and deactivate the plugin where you cannot promptly validate remediation.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.