Is CVE-2026-102379 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102379 being exploited in the wild.

How severe is CVE-2026-102379?

High severity, with a CVSS score of 8.5, published 1 October 2026.

Which products and versions are affected?

VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder up to 1.0.28.

How is CVE-2026-102379 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-102379?

Check whether you run VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102379: VillaTheme BuildKit Product Builder SQL injection

CVE-2026-102379 · Severity: high · CVSS 8.5 · Published 2026-10-01

BuildKit is a WooCommerce product builder plugin that allows store administrators and contributors to create custom products. A SQL injection vulnerability in this plugin allows attackers with contributor-level access to read, modify, or delete the entire database, including customer accounts and private purchase data.

Vendors: VillaTheme.

Quick answers

Is CVE-2026-102379 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102379 being exploited in the wild.
How severe is CVE-2026-102379?: High severity, with a CVSS score of 8.5, published 1 October 2026.
Which products and versions are affected?: VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder up to 1.0.28.
Is there a fix for CVE-2026-102379?: Yes: fixed in 1.0.29. Until then: Update the plugin immediately to version 1.0.29 or later. If unable to update, restrict contributor and higher-level access to trusted users only and monitor database access logs for suspicious activity. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102379 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-102379?: Check whether you run VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.0.29

Update the plugin immediately to version 1.0.29 or later. If unable to update, restrict contributor and higher-level access to trusted users only and monitor database access logs for suspicious activity.

Technical details

The plugin contains a blind SQL injection vulnerability in versions up to 1.0.28 that requires contributor-level privileges or higher to exploit. An authenticated attacker can inject arbitrary SQL commands to exfiltrate, modify, or destroy database records. The issue is resolved in version 1.0.29.

Affected products

VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder up to 1.0.28

Timeline

2026-09-25: disclosed: Reported to Patchstack
2026-10-01: advisory: Published by Patchstack and NVD as CVE-2026-102379
2026-10-01: patched: Version 1.0.29 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.