What is the CVSS score of CVE-2026-3396?

CVE-2026-3396 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Wcapf Ajax Product Filter For Woocommerce are affected by CVE-2026-3396?

CVE-2026-3396 is a SQL injection vulnerability in the WooCommerce Ajax Product Filter plugin that allows unauthenticated attackers to extract sensitive database information from affected WordPress…

Is there a public PoC exploit available for CVE-2026-3396?

Yes, a public proof-of-concept exploit is available for CVE-2026-3396. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-3396?

Within 24 hours: Identify all WordPress sites using WCAPF plugin and document current versions via admin dashboard or WP-CLI; disable or deactivate WCAPF on all installations. Within 7 days: evaluate alternative product filter solutions and begin migration testing in staging environment; implement Web Application Firewall rules to block SQL injection patterns targeting the 'post-author' parameter. Within 30 days: complete migration away from WCAPF to patched alternative or monitor for vendor patch release; conduct database audit for unauthorized access or data exfiltration post-vulnerability disclosure.

Wcapf Ajax Product Filter For Woocommerce CVE-2026-3396

EUVD-2026-20453 HIGH

SQL Injection (CWE-89)

2026-04-08 Wordfence

GHSA-qwrq-9cw3-gcpq

WordPress SQLi Wcapf Ajax Product Filter For Woocommerce Wordpress Plugin

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 08, 2026 - 11:46 euvd

EUVD-2026-20453

Analysis Generated

Apr 08, 2026 - 11:46 vuln.today

CVE Published

Apr 08, 2026 - 11:16 nvd

HIGH 7.5

DescriptionCVE.org

WCAPF - WooCommerce Ajax Product Filter plugin is vulnerable to time-based SQL Injection via the 'post-author' parameter in all versions up to, and including, 4.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

Time-based SQL injection in WCAPF (WooCommerce Ajax Product Filter) WordPress plugin versions up to 4.2.3 allows unauthenticated remote attackers to extract sensitive database information via the 'post-author' parameter. The vulnerability stems from inadequate input sanitization and SQL query preparation, enabling attackers to append malicious SQL commands to existing queries. EPSS data not provided, but the unauthenticated network-accessible attack vector and public disclosure via Wordfence Threat Intelligence create immediate exploitation risk for WordPress sites using this e-commerce filtering plugin. No active exploitation confirmed (not in CISA KEV), though publicly available proof-of-concept code exists in security advisories.

Technical ContextAI

This vulnerability affects the WCAPF WordPress plugin (shamimmoeen:wcapf_ajax_product_filter_for_woocommerce) used for filtering WooCommerce products. The root cause is CWE-89 (SQL Injection) in the class-wcapf-product-filter.php file where the 'post-author' parameter is processed. Time-based SQL injection exploits allow attackers to infer database contents by injecting SQL commands that introduce deliberate delays, measuring response times to extract data bit-by-bit even when direct output is not returned. The vulnerable code paths exist in multiple locations (lines 65, 81, 689, 739) where user-supplied input from the AJAX product filtering interface is incorporated into SQL queries without proper parameterization or prepared statements. WordPress database credentials and all WooCommerce-related data (customer information, orders, product catalogs) become accessible through this blind SQL injection technique.

RemediationAI

Upgrade immediately to WCAPF version 4.2.4 or later, which addresses the SQL injection vulnerability through proper input sanitization and parameterized query implementation. The patch was committed in changeset 3484080 visible at https://plugins.trac.wordpress.org/changeset/3484080/. WordPress administrators should update via the WordPress dashboard Plugins section or manually download the patched version from the official WordPress plugin repository. If immediate patching is not feasible, temporarily disable the WCAPF plugin until the update can be applied, though this will remove AJAX filtering functionality from the WooCommerce storefront. Review WordPress database logs and access logs for suspicious POST requests targeting the 'post-author' parameter or abnormal database query patterns indicating potential exploitation attempts. After patching, consider implementing Web Application Firewall (WAF) rules to detect SQL injection patterns as defense-in-depth. Monitor the Wordfence advisory for additional guidance on detection and remediation best practices.