CVE-2026-12753: WooCommerce Search Plugin SQLi Vulnerability

CVE-2026-12753 Overview

CVE-2026-12753 is a SQL Injection vulnerability affecting the Advance Product Search - Voice & Ajax Search for WooCommerce plugin for WordPress. The flaw resides in the handling of the s and match parameters, which are passed into SQL queries without sufficient escaping or preparation. All plugin versions up to and including 1.4.4 are affected. Unauthenticated attackers can append arbitrary SQL statements to existing queries to extract sensitive information from the WordPress database, including user credentials, session tokens, and customer order data stored by WooCommerce.

Critical Impact
Unauthenticated attackers can exfiltrate sensitive database contents from WooCommerce stores running the vulnerable plugin by injecting SQL through search parameters.

Affected Products

Advance Product Search - Voice & Ajax Search for WooCommerce (WordPress plugin) versions up to and including 1.4.4
WordPress sites running WooCommerce with this plugin installed and activated
WooCommerce storefronts exposing the plugin's Ajax search endpoints to unauthenticated visitors

Discovery Timeline

2026-07-16 - CVE-2026-12753 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-12753

Vulnerability Analysis

The vulnerability is a generic SQL Injection classified under [CWE-89]. The plugin exposes an Ajax-driven product search endpoint that accepts the s (search term) and match parameters from HTTP requests. These parameter values are concatenated directly into SQL statements executed against the WordPress database.

The plugin fails to invoke $wpdb->prepare() with proper placeholders and does not apply esc_sql() or sanitize_text_field() to the user-controlled input. Because the search endpoint is reachable without authentication, any remote actor can craft malicious query strings targeting the vulnerable Ajax handler. Affected code paths are referenced in inc/thaps-function.php at lines 34, 86, and 125 of the 1.4.4 release.

Root Cause

The root cause is insufficient input escaping combined with the absence of parameterized query construction. The s and match parameters flow from $_GET or $_POST superglobals directly into a dynamically built SQL string. Without prepared statements, attacker-supplied characters such as single quotes, UNION, and SQL comment markers are interpreted as query syntax rather than data.

Attack Vector

Exploitation is performed over the network with no authentication or user interaction. An attacker sends a crafted HTTP request to the plugin's Ajax search endpoint, supplying a malicious payload in the s or match parameter. Common exploitation techniques include UNION-based injection to read data from wp_users and time-based blind injection using SLEEP() to confirm exploitability. The vulnerability affects confidentiality but does not directly permit modification or destruction of data based on the CVSS vector.

See the Wordfence Vulnerability Analysis and the WordPress Plugin File Reference for the specific vulnerable code locations.

Detection Methods for CVE-2026-12753

Indicators of Compromise

HTTP requests to the plugin's Ajax search endpoint containing SQL keywords such as UNION, SELECT, SLEEP(, BENCHMARK(, or information_schema in the s or match parameters
Unusually long query strings or URL-encoded quote characters (%27, %22) targeting search parameters
Spikes in Ajax search requests from a single IP address or user agent, particularly outside normal shopping traffic patterns
Web server or mod_security logs showing 500 errors or delayed responses correlated with search parameter payloads

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect the s and match query parameters for SQL syntax and known injection signatures
Correlate WordPress debug.log entries and MySQL general query logs for anomalous SELECT statements originating from the plugin's search handler
Baseline normal search parameter length and character distribution, then alert on deviations such as payloads exceeding 200 characters or containing SQL operators

Monitoring Recommendations

Enable MySQL query logging for the WordPress database and forward logs to a centralized analytics platform for retention and search
Monitor outbound traffic from the web server for signs of database exfiltration, including large HTTP response bodies from the search endpoint
Track plugin version inventory across managed WordPress sites and alert when th-advance-product-search is present at version 1.4.4 or earlier

How to Mitigate CVE-2026-12753

Immediate Actions Required

Deactivate and remove the Advance Product Search - Voice & Ajax Search for WooCommerce plugin until a patched release is installed
Apply WAF virtual patching to block SQL syntax in the s and match request parameters targeting the plugin's Ajax endpoint
Rotate WordPress administrator passwords, secret keys in wp-config.php, and any API credentials stored in the database if exploitation is suspected
Review WooCommerce customer data and audit logs for signs of unauthorized database access

Patch Information

A plugin change set was committed in the WordPress plugin repository. Review the WordPress Plugin Change Set and upgrade to the fixed release published after version 1.4.4. Site operators should verify via the WordPress admin dashboard that the installed version reflects the patched release.

Workarounds

Restrict access to the plugin's Ajax search endpoint via IP allowlisting or authentication requirements at the reverse proxy level
Disable the plugin entirely on production storefronts until a patched version is available and validated
Enforce strict WAF rules that reject requests containing SQL metacharacters in search parameters, accepting a possible impact on legitimate search functionality

bash

# Example ModSecurity rule to block SQL keywords in the vulnerable parameters
SecRule ARGS:s|ARGS:match "@rx (?i)(union(\s|\/\*).*select|sleep\s*\(|benchmark\s*\(|information_schema)" \
  "id:1026127530,phase:2,deny,status:403,log,msg:'CVE-2026-12753 SQLi attempt in th-advance-product-search'"