CVE-2025-1514CWE-20

Active Products Tables for WooCommerce <= 1.0.6.7 - Unauthenticated Arbitrary Filter Call

High · published March 26, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
30.5
In the wild
Unconfirmed
What it is

The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to unauthorized filter calling due to insufficient restrictions on the get_smth() function in all versions up to, and including, 1.0.6.7. This makes it possible for unauthenticated attackers to call arbitrary WordPress filters with a single parameter.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00378 · 30.5th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-03-26T08:21Z
EPSS history
Timeline
  • 26 MAR 08:21Z
    Active Products Tables for WooCommerce <= 1.0.6.7 - Unauthenticated Arbitrary Filter Call
    cvelistv5