What is the CVSS score of CVE-2026-56070?

CVE-2026-56070 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of Advance Product Search are affected by CVE-2026-56070?

WordPress installations using the Advance Product Search plugin (versions ≤1.4.4) expose backend database contents to unauthenticated remote attackers via SQL injection.

How to fix or mitigate CVE-2026-56070?

Within 24 hours: Identify all WordPress instances running Advance Product Search plugin and immediately disable and remove it; check web server logs for suspicious SQL-like query patterns targeting the search parameter. Within 7 days: Review database access logs for unauthorized read patterns; conduct forensic analysis to identify if exploitation has occurred; document affected data scope. Within 30 days: Deploy a Web Application Firewall (WAF) rule blocking common SQL injection patterns; evaluate alternative WordPress search plugins; establish a WordPress security monitoring process for known vulnerable plugins.

Advance Product Search CVE-2026-56070

EUVD-2026-39723 CRITICAL

SQL Injection (CWE-89)

2026-06-26 audit@patchstack.com

GHSA-h8f9-g796-676q

WordPress SQLi Wordpress Plugin

9.3

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.5 HIGH

Unauthenticated remote SQLi (AV:N/AC:L/PR:N/UI:N) primarily enabling database read (C:H); I/A set to N as evidence points to data disclosure, and scope kept Unchanged absent clear cross-authority impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:56 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions.

AnalysisAI

Unauthenticated SQL injection in the WordPress "Advance Product Search" plugin (slug th-advance-product-search) through version 1.4.4 lets remote attackers inject crafted SQL via a search-facing parameter without any login. Because the CVSS vector marks privileges as none (PR:N) and a scope change (S:C), an attacker can reach and read backend database content reachable from the plugin's queries. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; the high 9.3 score is driven by the unauthenticated network vector and confidentiality impact rather than any confirmed in-the-wild activity.

Technical ContextAI

The affected component is a WordPress plugin that adds an enhanced product/search feature, typically used alongside WooCommerce storefronts. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable search input is concatenated into a database query without proper parameterization or sanitization, allowing the input to alter query structure. WordPress plugins execute queries through the global $wpdb interface against the shared WordPress/WooCommerce database (wp_users, wp_usermeta, wp_options, product tables, etc.), so a successful injection in plugin code can disclose data well beyond the plugin's own tables - consistent with the scope-changed (S:C) flag in the reported CVSS vector.

RemediationAI

No vendor-released patched version is identified in the available data, so the specific fix release cannot be cited; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/th-advance-product-search/vulnerability/wordpress-advance-product-search-plugin-1-4-4-sql-injection-vulnerability) and the plugin's WordPress.org/vendor page for the first release above 1.4.4 and upgrade once confirmed. Until a confirmed patched version is installed, compensating controls include deactivating and removing the Advance Product Search plugin entirely (trade-off: loses the enhanced search feature on the storefront); deploying a WAF/virtual-patch rule (e.g., Patchstack or Wordfence) to block SQL metacharacters on the plugin's search request parameter (trade-off: may break legitimate searches containing quotes or special characters); and restricting or rate-limiting access to the search/AJAX endpoint while monitoring database query logs for anomalous UNION/SELECT patterns. These are stopgaps only and should be removed once the upgrade is applied.