Active Products Tables for WooCommerce: unauthenticated SQL injection (CVE-2026-66436)
An unauthenticated SQL injection has been reported in the WordPress plugin Active Products Tables for WooCommerce. It is tracked as CVE-2026-66436 with a CVSS score of 9.3. The description contains no further details.
Checked in Shield: no
Who is affected
Affected versions are not disclosed yet. The issue concerns WordPress sites that have the Active Products Tables for WooCommerce plugin installed.
How to check
In the WordPress admin, open the plugin list and check whether Active Products Tables for WooCommerce is installed and which version it is. Follow the CVE-2026-66436 entry on NVD.
How to fix
No fixed version has been published yet. Watch for plugin updates and install the patch once available. If you do not need the plugin, you can deactivate it.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Affected and fixed versions and any exploitation are not disclosed yet. Source: NVD, CVE-2026-66436.
