# CVE-2026-102379: VillaTheme BuildKit Product Builder SQL injection

Source: https://junglewise.ai/threats/cve-2026-102379-improper-neutralization-of-special-elements-used-in-an-sql  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-102379 · Severity: high · CVSS 8.5 · Published 2026-10-01

BuildKit is a WooCommerce product builder plugin that allows store administrators and contributors to create custom products. A SQL injection vulnerability in this plugin allows attackers with contributor-level access to read, modify, or delete the entire database, including customer accounts and private purchase data.

Vendors: [VillaTheme](https://junglewise.ai/threats/vendors/villatheme).

## Quick answers

**Is CVE-2026-102379 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102379 being exploited in the wild.

**How severe is CVE-2026-102379?** High severity, with a CVSS score of 8.5, published 1 October 2026.

**Which products and versions are affected?** VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder up to 1.0.28.

**Is there a fix for CVE-2026-102379?** Yes: fixed in 1.0.29. Until then: Update the plugin immediately to version 1.0.29 or later. If unable to update, restrict contributor and higher-level access to trusted users only and monitor database access logs for suspicious activity. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102379 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-102379?** Check whether you run VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.0.29

Update the plugin immediately to version 1.0.29 or later. If unable to update, restrict contributor and higher-level access to trusted users only and monitor database access logs for suspicious activity.

## Technical details

The plugin contains a blind SQL injection vulnerability in versions up to 1.0.28 that requires contributor-level privileges or higher to exploit. An authenticated attacker can inject arbitrary SQL commands to exfiltrate, modify, or destroy database records. The issue is resolved in version 1.0.29.

## Affected products

- VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder up to 1.0.28

## Timeline

- 2026-09-25: disclosed: Reported to Patchstack
- 2026-10-01: advisory: Published by Patchstack and NVD as CVE-2026-102379
- 2026-10-01: patched: Version 1.0.29 released

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/woo-product-builder/vulnerability/wordpress-buildkit-product-builder-for-woocommerce-custom-pc-builder-plugin-1-0-28-sql-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/woo-product-builder/vulnerability/wordpress-buildkit-product-builder-for-woocommerce-custom-pc-builder-plugin-1-0-28-sql-injection-vulnerability?_s_id=cve)