Advance Product Search EUVD-2026-44857

Exploitation requires that the ThemeHunk Advance Product Search - Voice & Ajax Search for WooCommerce plugin (version ≤ 1.4.4) is installed and active on a WordPress/WooCommerce site, and that its AJAX/voice search endpoint accepting the 's' and 'match' parameters is reachable by the attacker. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, elevated privileges, non-default configuration, or user interaction is needed - it is remote unauthenticated exploitation against default configurations of the plugin. The primary limiting factor is simply whether this specific plugin is deployed and its search endpoint is internet-facing; impact is bounded to data disclosure (C:H, I:N/A:N), so the flaw alone reads data rather than modifying the site.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) is internally consistent with the description: network-reachable, low-complexity, unauthenticated, no user interaction, with high confidentiality impact but no integrity or availability impact - matching a read-only data-exfiltration SQLi. This is a genuinely attackable class: unauthenticated SQLi on a public endpoint is highly automatable and is a favored target for mass scanning of WordPress sites, so despite no KEV listing and no observed public PoC, the practical risk on exposed stores is meaningful. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The main mitigating factors are that impact is confined to confidentiality (no direct data tampering or site takeover via this flaw alone) and that real risk depends on the plugin being installed and its search endpoint reachable. Note a data gap: no fix version is present in the input, only a Trac changeset reference, so remediation certainty is limited.

An attacker crafts an HTTP request to the store's AJAX product-search endpoint, placing a UNION-based SQL payload in the 's' or 'match' parameter. Because no authentication, privileges, or user interaction are required and complexity is low, the injected clause executes against the WordPress database and returns administrator password hashes, session data, or customer order details in the search response. No public PoC has been identified, but the low-complexity unauthenticated nature makes automated mass exploitation straightforward if a working payload is developed.