What is the CVSS score of CVE-2026-12753?

CVE-2026-12753 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Advance Product Search are affected by CVE-2026-12753?

ThemeHunk's Advance Product Search plugin for WooCommerce (versions ≤1.4.4) contains an unauthenticated SQL injection vulnerability enabling attackers to extract customer credentials and order data…

How to fix or mitigate CVE-2026-12753?

Within 24 hours, audit all WordPress instances for ThemeHunk's Advance Product Search plugin version 1.4.4 or earlier and document current version status. Within 7 days, either deactivate the plugin immediately if operationally non-critical, or deploy Web Application Firewall (WAF) rules to block requests with SQL injection patterns in the 's' and 'match' parameters as emergency protection. Within 30 days, check ThemeHunk's advisory portal and WordPress plugin repository for patched version 1.4.5 or higher; prepare migration strategy to alternative WooCommerce search solutions if no patch emerges, and conduct forensic database audit to detect any unauthorized access or data extraction during the exposure period.

Advance Product Search CVE-2026-12753

EUVD-2026-44857 HIGH

SQL Injection (CWE-89)

2026-07-16 Wordfence

GHSA-88gq-qj38-4cpw

WordPress SQLi Wordpress Plugin Advance Product Search Voice Ajax Search For Woocommerce Themehunk

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable AJAX endpoint (AV:N/AC:L/PR:N/UI:N) with read-only SQLi yielding high confidentiality loss but no integrity or availability impact (C:H/I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 03:46 vuln.today

CVE Published

Jul 16, 2026 - 02:30 cve.org

HIGH 7.5

DescriptionCVE.org

The Advance Product Search- Voice & Ajax Search for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 's' and 'match' parameter in all versions up to, and including, 1.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Articles & Coverage 1

News 4 New WordPress Vulnerabilities - 4 High Severity, 2 With POC Jul 16, 2026

AnalysisAI

SQL injection in ThemeHunk's Advance Product Search - Voice & Ajax Search for WooCommerce plugin (all versions ≤ 1.4.4) lets unauthenticated attackers inject arbitrary SQL through the 's' and 'match' search parameters, enabling extraction of sensitive database contents such as user credentials and order data. The flaw stems from unescaped, unprepared query construction in the plugin's AJAX search backend and is remotely exploitable without authentication or user interaction. Reported by Wordfence; no public exploit identified at time of analysis and not listed in CISA KEV.

Technical ContextAI

The vulnerability is a classic CWE-89 SQL injection in a WooCommerce/WordPress search add-on. WordPress plugins are expected to sanitize input and build queries with $wpdb->prepare() placeholders; here the affected functions in inc/thaps-function.php (see referenced source lines 34, 86 and 125) concatenate the user-supplied 's' (search term) and 'match' parameters directly into an existing SQL statement without sufficient escaping or parameterization. Because the plugin exposes a public/AJAX search endpoint used by store front-ends, the injectable query runs against the WordPress database (wp_users, wp_usermeta, WooCommerce order and product tables), making it a 'generic' injection where an attacker can append UNION/subquery clauses to read arbitrary columns. The single affected package is identified by CPE cpe:2.3:a:themehunk:advance_product_search-_voice_&_ajax_search_for_woocommerce.

RemediationAI

Upgrade to a fixed release of the plugin above 1.4.4 as soon as one is confirmed by the vendor; a code fix is visible in the WordPress.org Trac changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3582785%40th-advance-product-search&new=3582785%40th-advance-product-search), so an upstream fix is available but a released patched version is not independently confirmed from the provided data - verify the current version on the plugin page before deploying. Until a patched version is installed, compensating controls include deploying a WAF rule (e.g. Wordfence) to block SQL metacharacters in the 's' and 'match' search parameters, which may cause false positives on legitimate searches containing quotes; temporarily deactivating the Advance Product Search plugin and reverting to WooCommerce's native search, which removes the voice/AJAX search feature; or restricting access to the plugin's AJAX search endpoint at the reverse proxy, with the trade-off of breaking front-end search for real customers. Consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/4aa8342f-1f36-4eb5-8b69-ab90fd85e5cb?source=cve) for detection signatures.