PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54836 YMC CVE debrief

A SQL Injection vulnerability exists in YMC Filter, a WordPress plugin, from version n/a through 3.11.5. This issue, known as CVE-2026-54836, was publicly disclosed on June 25, 2026, and last modified on October 25, 2026. The vulnerability has a CVSS score of 9.3 and is considered Critical. Defenders should assess exposure and prioritize verification and potential remediation. The CVE record and NVD entry provide limited information about the vulnerability and its impact. Further verification is required to determine the extent of exposure and potential consequences.

Vendor
YMC
Product
YMC Filter
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-25
Original CVE updated
2026-10-25
Advisory published
2026-06-25
Advisory updated
2026-10-25

Who should care

Defenders responsible for WordPress installations with the YMC Filter plugin should assess exposure and prioritize verification and potential remediation.

Why it matters

CVE-2026-54836 is a Critical SQL Injection vulnerability in the YMC Filter WordPress plugin. Defenders should prioritize verifying exposure and assessing potential consequences.

  • Potential for SQL injection attacks
  • Verification of YMC Filter installations required
  • Possible data exposure or manipulation

Technical summary

The YMC Filter WordPress plugin is vulnerable to SQL Injection, allowing attackers to inject malicious SQL code. The vulnerability exists from version n/a through 3.11.5. This issue arises from improper neutralization of special elements used in SQL commands. Defenders should prioritize verifying exposure of YMC Filter installations and assessing the potential for SQL injection attacks.

Defensive priority

Defenders should prioritize verifying exposure of YMC Filter installations and assessing the potential for SQL injection attacks.

Recommended defensive actions

  • Verify YMC Filter installations for version 3.11.5 or earlier
  • Assess potential for SQL injection attacks
  • Consider upgrading to a patched version if available

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability and its impact. Further verification is required to determine the extent of exposure and potential consequences.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-54836 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-54836

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-54836 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54836

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.