Executive brief
The Advance Product Search plugin for WordPress, which provides enhanced search functionality for e-commerce sites, contains a critical security flaw. An unauthenticated attacker can use this vulnerability to interact directly with the website's database. This could lead to the theft of sensitive customer information, administrative credentials, or the disruption of site operations.
Technical details
The Advance Product Search plugin for WordPress is vulnerable to an unauthenticated SQL injection via the 'th-advance-product-search' component in versions up to 1.4.4. The vulnerability arises from improper neutralization of user-supplied input used in SQL commands (CWE-89). A remote, unauthenticated attacker can exploit this by sending specially crafted web requests to the server, allowing them to execute arbitrary SQL queries. This can result in the extraction of sensitive data from the database or limited impact on service availability. The issue is resolved in version 1.4.5.
Affected products
- ThemeHunk (th-advance-product-search) Advance Product Search <= 1.4.4
Timeline
- 2026-06-19: disclosed: Reported by Mokksh Parekh
- 2026-06-25: advisory: Patchstack advisory published
- 2026-06-26: patched: Version 1.4.5 released to address the vulnerability