Executive brief
The WooCommerce Ajax Product Filter plugin, used to help customers filter products on e-commerce sites, contains a security flaw. An unauthorized attacker can use this flaw to extract sensitive information from the website's database. This could lead to the exposure of customer data or internal site configurations, potentially damaging the business's reputation and customer trust.
Technical details
The WCAPF plugin for WooCommerce is vulnerable to time-based SQL Injection due to insufficient escaping of the 'post-author' parameter and a lack of proper SQL query preparation. The vulnerability exists in the class-wcapf-product-filter.php component. An unauthenticated remote attacker can exploit this by sending crafted requests to append malicious SQL commands to existing queries. This enables the extraction of sensitive data from the WordPress database. The issue is addressed in versions following 4.2.3.
Affected products
- shamimmoeen WCAPF – Ajax Product Filter for WooCommerce <= 4.2.3
Timeline
- 2026-04-08: disclosed
- 2026-04-08: advisory
References
- https://plugins.trac.wordpress.org/browser/wc-ajax-product-filter/trunk/includes/class-wcapf-product-filter.php
- https://plugins.trac.wordpress.org/browser/wc-ajax-product-filter/trunk/includes/class-wcapf-product-filter.php
- https://plugins.trac.wordpress.org/browser/wc-ajax-product-filter/trunk/includes/class-wcapf-product-filter.php
- https://plugins.trac.wordpress.org/browser/wc-ajax-product-filter/trunk/includes/class-wcapf-product-filter.php
- https://plugins.trac.wordpress.org/changeset/3484080/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ee0a762e-9159-4dab-a7be-9cbe332effb1?source=cve