CVE-2026-102379
8.5 HIGHPublished 2026-10-01 · Updated 2026-10-01
AI risk analysis
- Summary
- This vulnerability allows Blind SQL Injection, enabling attackers to extract data from the database by manipulating SQL queries. It is significant because it can lead to data leakage and potential further exploitation.
- Exploitability
- Exploitation is moderately difficult as it requires crafting specific input to trigger the SQL injection, but preconditions include the presence of the affected version of the plugin.
- Blast radius
- If exploited, this could result in unauthorized data access, potentially leading to the exposure of sensitive information stored in the database.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to BuildKit – Product Builder for WooCommerce – Custom PC Builder 1.0.29 or later.
sql-injectionblind-sqlweb
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Blind SQL Injection.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0.28.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Weaknesses
CWE-89
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-103066
- HIGHCVE-2026-103338
- CRITICALCVE-2026-103352
- CRITICALCVE-2026-103355
- HIGHCVE-2026-105076
- CRITICALCVE-2026-105889
- HIGHCVE-2026-62059
- HIGHCVE-2026-62097
Related by shared AI tags and CWE weakness class. Browse the full archive.