SQL Injection Vulnerability in Advance Product Search for WooCommerce Plugin
CVE-2026-12753

7.5HIGH

Key Information:

Vendor

WordPress
Status
Advance Product Search- Voice & Ajax Search For WooCommerce
Vendor
CVE Published:
16 July 2026

What is CVE-2026-12753?

The Advance Product Search - Voice & Ajax Search for WooCommerce plugin for WordPress has a vulnerability that allows unauthenticated users to execute SQL Injection attacks. This is due to insufficient escaping of user-supplied input in the 's' and 'match' parameters, combined with the inadequate preparation of SQL queries. An attacker could manipulate these parameters to append malicious SQL statements, potentially exposing sensitive data from the database.

Affected Version(s)

Advance Product Search- Voice & Ajax Search for WooCommerce 0 <= 1.4.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/th-advance-pro...
https://plugins.trac.wordpress.org/browser/th-advance-pro...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

PRISM
.