CVE-2026-42664: WordPress AI Product Search for WooCommerce – Motive Commerce Search plugin <= 1.38.2 - Broken Access Control vulnerability

Synopsis

A broken access control vulnerability in the AI Product Search for WooCommerce plugin (Motive Commerce Search, versions 1.38.2 and earlier) allows unauthenticated remote attackers to reach restricted functionality without logging in. The flaw is reachable over the network and requires no credentials or victim interaction. Successful exploitation allows an attacker to tamper with plugin data or configuration and to crash or deny access to the affected service. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The plugin endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the target WordPress/WooCommerce host.

• AuthenticationNot required

  No account or session token is needed; the access control bypass is reachable by any unauthenticated request.

• Victim interactionNot required

  The attacker interacts directly with the server-side endpoint and does not need any action from a site user or administrator.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions.

Blast Radius

• An attacker can modify plugin settings or stored data, altering how product search results are generated or displayed to shoppers.
• An attacker can trigger a denial-of-service condition that crashes or makes the affected search service unavailable, disrupting storefront search functionality.
• No confidential data exposure is indicated by the CVSS vector (Confidentiality impact is None), so direct theft of customer records or credentials is not a consequence of this specific flaw.