CVE-2026-108489

5.3Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-201

Impact

Unauthenticated remote attackers can read sensitive data exposed in sent responses. They only need network access to the target WordPress site.

Root cause

The plugin inserts sensitive information into data sent over the network instead of stripping it out.

Affected systems

Active Products Tables for WooCommerce (profit-products-tables-for-woocommerce) through 2.1.3.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade to a version newer than 2.1.3 once available; if no patched release exists yet, deactivate and remove the profit-products-tables-for-woocommerce plugin.

shell

$ wp plugin deactivate profit-products-tables-for-woocommerce

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.3.

References

https://patchstack.com/database/wordpress/plugin/profit-products-tables-for-woocommerce/vulnerability/wordpress-active-products-tables-for-woocommerce-plugin-2-1-3-sensitive-data-exposure-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-108489