PHP Object Injection Vulnerability in Advanced AJAX Product Filters for WordPress

CVE-2026-1426

What is CVE-2026-1426?

The Advanced AJAX Product Filters plugin for WordPress is susceptible to PHP Object Injection due to improper handling of untrusted input during the deserialization process in the shortcode_check function of the Live Composer compatibility layer. This vulnerability can be exploited by authenticated users with Author-level privileges or higher, allowing them to inject a PHP Object. While the vulnerability itself does not directly result in harmful actions, it poses a significant risk if combined with another plugin or theme that contains a PHP Object Pollution (POP) chain. If such a chain is present, attackers may gain capabilities to delete files, access sensitive data, or execute malicious code on the affected system, particularly if the Live Composer plugin is also active.

References