CVE-2026-108151: WordPress MDTF plugin <= 1.3.9 - Arbitrary Code Execution vulnerability
Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Code Injection.This issue affects MDTF: from n/a through 1.3.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filterto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Which MDTF installations are affected?
MDTF versions through 1.3.9 are affected. The available data does not identify a fixed version.
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the potential impact of successful exploitation?
The issue is classified as code injection and arbitrary code execution. The CVSS vector indicates low confidentiality impact, with no stated integrity or availability impact.