{"id":"CVE-2026-102379","published":"2026-10-01T13:17:07.297","lastModified":"2026-10-01T14:34:35.357","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Blind SQL Injection.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0.28.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/woo-product-builder/vulnerability/wordpress-buildkit-product-builder-for-woocommerce-custom-pc-builder-plugin-1-0-28-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows Blind SQL Injection, enabling attackers to extract data from the database by manipulating SQL queries. It is significant because it can lead to data leakage and potential further exploitation.","exploitability":"Exploitation is moderately difficult as it requires crafting specific input to trigger the SQL injection, but preconditions include the presence of the affected version of the plugin.","blast_radius":"If exploited, this could result in unauthorized data access, potentially leading to the exposure of sensitive information stored in the database.","remediation":"Upgrade to BuildKit – Product Builder for WooCommerce – Custom PC Builder 1.0.29 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","blind-sql","web"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-04T08:41:47.185Z"}}