PT-2026-60399 · WordPress · Advance Product Search- Voice & Ajax Search For Woocommerce

Prism · Published 2026-07-16 · Updated 2026-07-16 · CVE-2026-12753

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Advance Product Search- Voice & Ajax Search for WooCommerce versions prior to 1.4.5

Description An issue exists where unauthenticated attackers can append additional SQL queries to existing ones to extract sensitive information from the database. This occurs due to insufficient escaping of user-supplied parameters and a lack of sufficient preparation of the SQL query. The flaw is triggered via the 's' and match parameters in the search functionality.

Recommendations Update Advance Product Search- Voice & Ajax Search for WooCommerce to version 1.4.5 or later. As a temporary mitigation, restrict access to the search functionality that utilizes the s and match parameters.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-12753

Affected Products

Advance Product Search- Voice & Ajax Search For Woocommerce

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-12753 · Security Note
• https://plugins.trac.wordpress.org/browser/th-advance-product-search/tags/1.4.4/inc/thaps-function.php#L125 · Note
• https://plugins.trac.wordpress.org/browser/th-advance-product-search/tags/1.4.4/inc/thaps-function.php#L86 · Note
• https://plugins.trac.wordpress.org/browser/th-advance-product-search/tags/1.4.4/inc/thaps-function.php#L34 · Note
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3582785%40th-advance-product-search&new=3582785%40th-advance-product-search · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4aa8342f-1f36-4eb5-8b69-ab90fd85e5cb?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2077636483649872012 · Twitter Post