CVE-2026-42664 Overview
CVE-2026-42664 is an unauthenticated broken access control vulnerability in the AI Product Search for WooCommerce – Motive Commerce Search plugin for WordPress. The flaw affects all plugin versions up to and including 1.38.2. The issue is classified under [CWE-862] Missing Authorization, allowing network-based attackers to invoke protected plugin functionality without credentials. The vulnerability impacts integrity at a low level and availability at a high level, with no confidentiality impact reported.
Critical Impact
Remote unauthenticated attackers can abuse missing authorization checks to modify plugin state or trigger conditions that disrupt WooCommerce store availability.
Affected Products
- AI Product Search for WooCommerce – Motive Commerce Search plugin (WordPress)
- All versions up to and including 1.38.2
- WordPress sites running WooCommerce with this plugin installed
Discovery Timeline
- 2026-06-15 - CVE-2026-42664 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-42664
Vulnerability Analysis
The vulnerability stems from missing authorization checks on one or more plugin endpoints. The plugin exposes functionality that should require authenticated, privileged access, but performs no capability or nonce verification before executing sensitive operations. An unauthenticated attacker reaches the vulnerable handlers over the network with low attack complexity and no user interaction.
The Patchstack advisory categorizes the issue as Broken Access Control. According to the CVSS metrics, exploitation yields low integrity impact and high availability impact, indicating attackers can alter limited plugin state and induce service disruption. The EPSS probability is 0.254%, placing the CVE in the 16th percentile for near-term exploitation likelihood.
Root Cause
The root cause is [CWE-862] Missing Authorization. Plugin request handlers do not validate the caller's identity or role before performing actions. WordPress plugins typically enforce access using current_user_can() capability checks and check_ajax_referer() or wp_verify_nonce() nonce verification. The absence of these guards on protected actions exposes them to anonymous requests.
Attack Vector
An attacker sends crafted HTTP requests to the vulnerable plugin endpoint on a target WordPress site. Because no authentication or authorization is required, the request executes the protected logic directly. Repeated or malformed invocations can corrupt plugin configuration or exhaust resources, producing the high availability impact reflected in the CVSS vector. Refer to the Patchstack Vulnerability Report for endpoint-level details.
Detection Methods for CVE-2026-42664
Indicators of Compromise
- Unauthenticated HTTP POST or GET requests to admin-ajax.php or REST routes registered by the Motive Commerce Search plugin
- Unexpected modifications to plugin settings, search indexes, or product metadata without a corresponding admin login
- Spikes in 200-status responses to plugin endpoints originating from unauthenticated sessions
Detection Strategies
- Review WordPress access logs for requests to plugin-specific AJAX actions or REST namespaces lacking authentication cookies
- Correlate plugin configuration changes against authenticated admin session timestamps
- Deploy a Web Application Firewall (WAF) rule set that flags anonymous calls to Motive Commerce Search endpoints
Monitoring Recommendations
- Enable WordPress audit logging to track plugin option changes and user capability events
- Monitor outbound traffic from the WordPress host for anomalous patterns following inbound plugin requests
- Alert on availability degradation of WooCommerce storefronts that correlates with traffic to the affected plugin paths
How to Mitigate CVE-2026-42664
Immediate Actions Required
- Inventory all WordPress sites and identify installations of AI Product Search for WooCommerce – Motive Commerce Search at version 1.38.2 or earlier
- Update the plugin to the vendor-released fixed version referenced in the Patchstack advisory
- If a patched version is not yet available in your environment, deactivate and remove the plugin until remediation is verified
Patch Information
Users must upgrade beyond version 1.38.2. Consult the Patchstack Vulnerability Report for the fixed release version and vendor changelog.
Workarounds
- Block unauthenticated requests to the plugin's AJAX and REST endpoints at the WAF or reverse proxy layer
- Restrict access to /wp-admin/admin-ajax.php actions registered by the plugin using IP allowlists where feasible
- Disable the plugin on production sites until the patched version is deployed and verified
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
