# CVE-2026-12753: ThemeHunk Advance Product Search SQL injection in s and match parameters

Source: https://junglewise.ai/threats/cve-2026-12753-themehunk-advance-product-search-sql-injection-in-s-and-match  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-12753 · Severity: high · CVSS 7.5 · Published 2026-07-16

The Advance Product Search plugin for WooCommerce, which provides voice and instant search functionality for online stores, contains a security flaw. This vulnerability allows unauthorized individuals to bypass security controls and access sensitive information stored in the website's database. This could lead to the exposure of customer data or internal site configurations, potentially damaging the business's reputation and operational security.

Vendors: [ThemeHunk](https://junglewise.ai/threats/vendors/themehunk).

## Quick answers

**Is CVE-2026-12753 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12753 being exploited in the wild.

**How severe is CVE-2026-12753?** High severity, with a CVSS score of 7.5, published 16 July 2026.

**Which products and versions are affected?** ThemeHunk Advance Product Search- Voice & Ajax Search for WooCommerce up to, and including, 1.4.4.

**Is there a fix for CVE-2026-12753?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12753 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12753?** Check whether you run ThemeHunk Advance Product Search- Voice & Ajax Search for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Advance Product Search- Voice & Ajax Search for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection due to insufficient escaping and lack of proper preparation on SQL queries within the 's' and 'match' parameters. The flaw exists in the thaps-function.php file. An unauthenticated attacker can exploit this by sending crafted web requests to append malicious SQL commands to existing queries. This enables the extraction of sensitive data from the WordPress database. The issue affects all versions up to and including 1.4.4; users should update to a patched version if available.

## Affected products

- ThemeHunk Advance Product Search- Voice & Ajax Search for WooCommerce up to, and including, 1.4.4

## Timeline

- 2026-07-16: advisory: NVD publication date

## References

- [https://plugins.trac.wordpress.org/browser/th-advance-product-search/tags/1.4.4/inc/thaps-function.php](https://plugins.trac.wordpress.org/browser/th-advance-product-search/tags/1.4.4/inc/thaps-function.php)
- [https://plugins.trac.wordpress.org/browser/th-advance-product-search/tags/1.4.4/inc/thaps-function.php](https://plugins.trac.wordpress.org/browser/th-advance-product-search/tags/1.4.4/inc/thaps-function.php)
- [https://plugins.trac.wordpress.org/browser/th-advance-product-search/tags/1.4.4/inc/thaps-function.php](https://plugins.trac.wordpress.org/browser/th-advance-product-search/tags/1.4.4/inc/thaps-function.php)
- [https://plugins.trac.wordpress.org/changeset?reponame=&old=3582785%40th-advance-product-search&new=3582785%40th-advance-product-search](https://plugins.trac.wordpress.org/changeset?reponame=&old=3582785%40th-advance-product-search&new=3582785%40th-advance-product-search)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/4aa8342f-1f36-4eb5-8b69-ab90fd85e5cb?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/4aa8342f-1f36-4eb5-8b69-ab90fd85e5cb?source=cve)