CVE-2026-102379: WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Blind SQL Injection.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0.28.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builderto a version that resolves this vulnerability.Fixed in 1.0.29
Event History
Frequently Asked Questions
Which installations are affected?
The affected product is VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder. Versions through 1.0.28 are affected; the available data does not identify a fixed version.
What access does an attacker need to exploit this issue?
The CVSS vector indicates network-reachable exploitation with low attack complexity, no user interaction, and low privileges required. This means an attacker must have an account or other access level corresponding to low privileges.
What is the potential impact?
The issue is a blind SQL injection vulnerability. The reported CVSS vector indicates high confidentiality impact, no integrity impact, low availability impact, and scope change.