CVE-2026-56070: WordPress Advance Product Search plugin <= 1.4.4 - SQL Injection vulnerability

Synopsis

This is an unauthenticated SQL injection vulnerability in the Advance Product Search WordPress plugin by ThemeHunk, affecting all versions up to and including 1.4.4. The flaw is reachable over the network with no account or authentication required, making it trivially accessible to any remote attacker. Successful exploitation allows an attacker to read data from the underlying database and cause limited disruption to service availability. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable search endpoint is exposed over the network and must be reachable by the attacker to send a malicious SQL payload.

• AuthenticationNot required

  No account or session token is needed; the injection point is accessible to any anonymous HTTP request.

• Victim interactionNot required

  The attacker sends requests directly to the service and no user action is required to trigger the vulnerability.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable with no race conditions or environmental dependencies required.

Blast Radius

• Attacker reads arbitrary rows from the WordPress database, including user credentials, email addresses, and stored session tokens.
• Database contents such as order records, product data, and any custom post meta stored in the site are exposed to exfiltration.
• The A:L impact token indicates the attacker can degrade availability of the search feature or cause partial service disruption through malformed queries.