CVE-2026-108151

Deferred Deferred - Pending Action

Code Injection in MDTF wp-meta-data-filter-and-taxonomy-filter

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Patchstack

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Code Injection.This issue affects MDTF: from n/a through 1.3.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-108151

EUVD

EUVD-2026-101524

Affected Vendors & Products

Vendor	Product	Version / Range
PluginUs.Net	MDTF	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This is a code injection vulnerability in the WordPress MDTF plugin (versions 1.3.9 and below) that allows attackers to execute arbitrary code on the server. It is classified as medium severity with a CVSS score of 5.3. The issue enables unauthorized code execution, potentially giving attackers control over the affected website.

Detection Guidance

To detect this vulnerability, check the installed version of the MDTF plugin. If it is 1.3.9 or below, the system is vulnerable. Use commands like 'wp plugin list' in WordPress or inspect the plugin directory for version details. Patchstack also provides a mitigation rule to block attacks until the plugin is updated.

Impact Analysis

An attacker could exploit this to run malicious code on your server, potentially taking over your website, stealing data, or using your site for further attacks. Even if no data is stolen, the unauthorized code execution poses a significant security risk to your system and users.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and security. Non-compliance may result in legal penalties, fines, or reputational damage due to exposed sensitive information.

Mitigation Strategies

Update the MDTF plugin to version 1.4.0 or later immediately to patch the vulnerability. If updating is not possible, apply the mitigation rule provided by Patchstack to block attacks until the plugin can be updated.

Hi! I’m here to help you understand CVE-2026-108151. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70