CVE-2026-1426: WordPress AJAX Filters PHP Object Injection

CVE-2026-1426 Overview

The Advanced AJAX Product Filters plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.1.9.6. This vulnerability exists due to the deserialization of untrusted input in the shortcode_check function within the Live Composer compatibility layer. Authenticated attackers with Author-level access or higher can exploit this flaw to inject a PHP Object, potentially leading to severe consequences when combined with an existing POP (Property Oriented Programming) chain.

Critical Impact

When a POP chain is present via another installed plugin or theme, attackers can delete arbitrary files, retrieve sensitive data, or execute arbitrary code on the target WordPress installation.

Affected Products

• Advanced AJAX Product Filters plugin for WordPress versions up to and including 3.1.9.6
• WordPress sites with Live Composer plugin installed and active (required for exploitation)
• WordPress installations with additional plugins or themes containing POP chains (for full exploitation)

Discovery Timeline

• February 18, 2026 - CVE-2026-1426 published to NVD
• February 18, 2026 - Last updated in NVD database

Technical Details for CVE-2026-1426

Vulnerability Analysis

This vulnerability is classified as CWE-502: Deserialization of Untrusted Data. The flaw occurs within the Live Composer compatibility layer of the Advanced AJAX Product Filters plugin. The shortcode_check function fails to properly validate or sanitize input before passing it to PHP's deserialization functions. This allows an authenticated attacker to inject malicious serialized PHP objects.

While no known POP chain exists within the vulnerable plugin itself, the risk escalates significantly when combined with other WordPress plugins or themes that contain exploitable gadget chains. Successful exploitation could enable an attacker to perform arbitrary file deletion, sensitive data exfiltration, or remote code execution depending on the available POP chain.

Root Cause

The root cause of this vulnerability lies in the unsafe handling of user-supplied data within the shortcode_check function located in the live_composer.php compatibility file. The function accepts and deserializes input without proper validation, allowing attackers to craft malicious serialized objects. The vulnerable code paths can be examined in the WordPress Plugin Repository.

Attack Vector

The attack requires network access and authentication with at least Author-level privileges. The attacker can exploit this vulnerability by crafting a malicious serialized PHP object and submitting it through the affected shortcode functionality. The deserialization process then instantiates the attacker-controlled object, triggering any magic methods defined within available POP chains.

The exploitation flow typically involves:

1. Identifying that the target site has both Advanced AJAX Product Filters and Live Composer plugins installed
2. Enumerating installed plugins and themes to identify available POP chains
3. Crafting a serialized PHP payload that leverages the identified POP chain
4. Submitting the payload through the vulnerable shortcode functionality
5. The deserialization triggers the POP chain, executing the attacker's intended actions

For detailed technical analysis, refer to the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-1426

Indicators of Compromise

• Unusual POST requests containing serialized PHP objects (strings starting with O: or a:) targeting WordPress shortcode endpoints
• Unexpected file deletions or modifications within the WordPress installation directory
• Anomalous database queries or data extraction activities by Author-level user accounts
• Error logs showing PHP unserialization warnings or object instantiation failures

Detection Strategies

• Monitor web application logs for requests containing serialized PHP data patterns in POST parameters
• Implement Web Application Firewall (WAF) rules to detect and block serialized object injection attempts
• Enable WordPress activity logging to track shortcode execution and user actions
• Review authentication logs for unusual Author-level account activity or privilege escalation attempts

Monitoring Recommendations

• Deploy file integrity monitoring to detect unauthorized changes to WordPress core files, plugins, and themes
• Configure alerting for suspicious PHP error logs related to object deserialization failures
• Implement real-time monitoring of outbound network connections that may indicate data exfiltration
• Regularly audit installed plugins and themes for known POP chains that could be exploited in combination with this vulnerability

How to Mitigate CVE-2026-1426

Immediate Actions Required

• Update the Advanced AJAX Product Filters plugin to a version newer than 3.1.9.6 immediately
• Temporarily deactivate the Live Composer plugin if the update cannot be applied promptly
• Review Author-level and above user accounts for any unauthorized or suspicious users
• Audit installed plugins and themes for known POP chains and remove unnecessary components

Patch Information

A security patch addressing this vulnerability has been released. The fix is documented in the WordPress Plugin Changeset. Site administrators should update to the latest version of the Advanced AJAX Product Filters plugin through the WordPress admin panel or by downloading the updated version from the WordPress Plugin Directory.

Workarounds

• Disable or deactivate the Live Composer plugin if it is not essential to site functionality (this removes the vulnerable compatibility layer)
• Restrict Author-level and above access to only trusted users until the patch is applied
• Implement a Web Application Firewall rule to block requests containing serialized PHP object patterns
• Remove unnecessary plugins and themes that may contain exploitable POP chains to reduce the attack surface

# Configuration example - WordPress WAF rule for ModSecurity
# Block requests containing serialized PHP objects
SecRule ARGS "@rx O:\d+:\"" "id:100001,phase:2,deny,status:403,msg:'PHP Object Injection Attempt Blocked'"
SecRule ARGS "@rx a:\d+:{" "id:100002,phase:2,deny,status:403,msg:'PHP Array Injection Attempt Blocked'"