What is the CVSS score of CVE-2026-1426?

CVE-2026-1426 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-1426?

The Advanced AJAX Product Filters WordPress plugin contains a PHP Object Injection vulnerability affecting versions up to 3.1.9.6 that could allow authenticated users with Author-level or higher…

How to fix or mitigate CVE-2026-1426?

Within 24 hours: Audit all installed WordPress plugins and themes to identify potential POP (Property-Oriented Programming) chains that could amplify this vulnerability; document plugin inventory and versions. Within 7 days: Disable the Advanced AJAX Product Filters plugin or implement strict role-based access controls limiting Author-level permissions to trusted users only. Within 30 days: Monitor vendor for security patches and evaluate alternative product filter solutions; conduct a security assessment of all Author-level user accounts and audit their recent activities.

PHP CVE-2026-1426

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-02-18 security@wordfence.com

WordPress PHP Deserialization

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 18, 2026 - 15:18 nvd

HIGH 8.8

DescriptionCVE.org

The Advanced AJAX Product Filters plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.9.6 via deserialization of untrusted input in the shortcode_check function within the Live Composer compatibility layer. This makes it possible for authenticated attackers, with Author-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Note: This vulnerability requires the Live Composer plugin to also be installed and active.

AnalysisAI

PHP Object Injection in the Advanced AJAX Product Filters plugin for WordPress (versions up to 3.1.9.6) allows authenticated authors and above to deserialize malicious objects through the Live Composer compatibility layer. While the plugin itself lacks a gadget chain for exploitation, the vulnerability can enable arbitrary file deletion, data theft, or remote code execution if a POP chain exists in installed themes or plugins. No patch is currently available, and exploitation requires valid WordPress user credentials.

Technical ContextAI

This vulnerability (CWE-502: Deserialization of Untrusted Data) exists in the shortcode_check component. The Advanced AJAX Product Filters plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.9.6 via deserialization of untrusted input in the shortcode_check function within the Live Composer compatibility layer. This makes it possible for authenticated attackers, with Author-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or them