The Active Products Tables for WooCommerce plugin contains an insufficiently restricted function that allows callers to trigger any WordPress filter with a single parameter. This lack of authentication opens the door for unauthenticated attackers to invoke arbitrary filters, potentially executing arbitrary PHP code or modifying site behavior. The weakness is a classic case of improper input validation, identified as CWE-20. The impact of a successful exploitation episode could be full control over the affected WordPress site, jeopardizing confidentiality, integrity and availability.

The vulnerability affects the realmag777 Active Products Tables for WooCommerce – Use constructor to create tables plugin for WordPress, specifically all releases through 1.0.6.7. Users who have not upgraded beyond this version are at risk.

The CVSS score of 7.3 indicates a high severity, while the EPSS score of less than 1% shows a very low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog, suggesting no documented exploits exist yet, but the nature of the flaw allows attackers to conduct arbitrary filter calls remotely, which could be leveraged to execute remote code if malicious filters are present or injected.