CVE-2026-56070: Advance Product Search SQLi Vulnerability

CVE-2026-56070 Overview

CVE-2026-56070 is an unauthenticated SQL injection vulnerability in the WordPress th-advance-product-search plugin (Advance Product Search) affecting versions up to and including 1.4.4. The flaw allows remote attackers to inject arbitrary SQL statements through the plugin's search interface without any authentication or user interaction. Successful exploitation exposes database contents and can affect components beyond the vulnerable plugin scope. The vulnerability is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Remote, unauthenticated attackers can read sensitive data from the WordPress database, including user credentials and session tokens, by sending crafted requests to affected sites.

Affected Products

WordPress plugin: Advance Product Search (th-advance-product-search)
All plugin versions <= 1.4.4
WordPress sites running the plugin with the search feature exposed to unauthenticated visitors

Discovery Timeline

2026-06-26 - CVE-2026-56070 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-56070

Vulnerability Analysis

The vulnerability resides in the search request handler exposed by the Advance Product Search plugin. User-supplied input from the search endpoint is concatenated into an SQL query without proper sanitization or parameterized binding. Because the endpoint accepts requests from unauthenticated visitors, any anonymous attacker can reach the sink over the network.

SQL injection at this location permits an attacker to break out of the intended query context and append arbitrary SQL clauses. The scope classification indicates the impact extends beyond the vulnerable plugin, reflecting that WordPress core tables (including wp_users and wp_options) share the same database connection.

Root Cause

The root cause is failure to neutralize special SQL characters in user-controlled parameters before use in a database query. The plugin does not employ $wpdb->prepare() with placeholder binding, nor does it apply input allow-listing for the affected parameter. This corresponds directly to CWE-89.

Attack Vector

Exploitation requires only network access to a WordPress site running the vulnerable plugin. The attacker submits a crafted HTTP request to the plugin's search endpoint containing SQL metacharacters and injected clauses such as UNION SELECT payloads. No credentials, cookies, or user interaction are required. Full technical details are available in the Patchstack Vulnerability Advisory.

As of the publication date, no public proof-of-concept exploit or evidence of in-the-wild exploitation has been reported. The current EPSS probability is 0.236%.

Detection Methods for CVE-2026-56070

Indicators of Compromise

HTTP requests to the Advance Product Search endpoint containing SQL keywords such as UNION, SELECT, SLEEP(, BENCHMARK(, or INFORMATION_SCHEMA in query parameters.
Web server access logs showing repeated search requests from a single source with encoded characters (%27, %20OR%20, %23).
Unusual wp_users or wp_usermeta read patterns in database query logs.
Outbound DNS or HTTP requests originating from the database host, which may indicate out-of-band SQLi exfiltration.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule set with SQL injection signatures targeting the plugin's search parameter names.
Enable MySQL/MariaDB general query logging on staging or high-value hosts to identify anomalous UNION-based queries against wp_ tables.
Correlate spikes in search endpoint traffic with 500-level HTTP responses, which frequently indicate injection attempts triggering database errors.

Monitoring Recommendations

Monitor WordPress installations for the presence of th-advance-product-search plugin at version <= 1.4.4 using asset inventory tooling.
Alert on unauthenticated requests to plugin search endpoints exceeding baseline volumes.
Track database error events surfaced in wp-content/debug.log or PHP error logs.

How to Mitigate CVE-2026-56070

Immediate Actions Required

Update the Advance Product Search plugin to a fixed version above 1.4.4 as soon as it is published by the vendor.
If no patched release is yet available, deactivate and remove the plugin from all WordPress installations.
Rotate WordPress administrator passwords, secret keys in wp-config.php, and any API tokens stored in the database if exploitation is suspected.
Review recent access logs for evidence of exploitation attempts against the search endpoint.

Patch Information

At the time of publication, refer to the Patchstack Vulnerability Advisory for the latest patch status. Any plugin version above 1.4.4 released by the vendor addressing CWE-89 should be applied immediately.

Workarounds

Restrict access to the plugin's search endpoint at the WAF or reverse proxy layer using signature rules that block SQL metacharacters in the affected parameters.
Apply a virtual patch via a WordPress security plugin that supports Patchstack advisories.
Enforce least-privilege database credentials for the WordPress user so that injected queries cannot read tables outside the site's schema.

bash

# Example: disable the vulnerable plugin via WP-CLI on affected hosts
wp plugin deactivate th-advance-product-search --all-network
wp plugin delete th-advance-product-search