CVE-2026-3396

published 2026-04-08

CVE-2026-3396: WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable to time-based SQL Injection via the 'post-author' parameter in all versions up to, and including…

Priority P2 61 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable to time-based SQL Injection via the 'post-author' parameter in all versions up to, and including, 4.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
shamimmoeen	wcapf_ajax_product_filter_for_woocommerce	<= 4.2.3	—

Detection & IOCs extracted from sources · hover to see the quote

other post-author (time-based SQL Injection parameter)↗

sigma

title: WCAPF WooCommerce Ajax Product Filter - SQL Injection
detection:
  selection:
    - 'contains(body, "No results found")'
    - 'status_code == 200'
  condition: and

• → Monitor HTTP requests targeting the WCAPF plugin's 'post-author' parameter for time-based SQL Injection payloads (e.g., SLEEP/BENCHMARK injections). No authentication is required — flag unauthenticated requests manipulating this parameter. ↗
• → A nuclei-style template fingerprints exploitation by checking for 'No results found' in the response body with HTTP 200 status — alert on this combination when the 'post-author' parameter contains SQL metacharacters (e.g., single quote followed by numeric comparison).
• → Scope detection to WCAPF WooCommerce Ajax Product Filter plugin versions up to and including 4.2.3; requests to the plugin's Ajax endpoint with a manipulated 'post-author' value are the primary attack surface. ↗

• · The vulnerability is exploitable by unauthenticated users, meaning no session or privilege level filtering will reduce exposure — WAF/IDS rules must cover unauthenticated request paths to the plugin endpoint. ↗
• · The nuclei template digest (4a0a00473045...) can be used to verify template integrity but is not itself an attack IOC; do not block on this value in network traffic.

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89