External risk intelligence

Advance Product Search SQL Injection Vulnerability in versions up to 1.4.4

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-56070

The vulnerability affects a WordPress plugin designed for product search functionality, which is typically deployed as a public-facing component of a website to allow user interaction, making it reachable from the internet by design.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns an unauthenticated SQL injection vulnerability in the Advance Product Search tool. The issue allows for unauthorized data access and manipulation by bypassing standard security checks, potentially impacting systems that use this search functionality. The primary concern is confirming whether this specific tool is in use and, if so, understanding its exposure.

Unauthorized data access via search tool.
Matters if the product search tool is deployed.
Verify relevance and exposure of this tool.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to a website using the affected product search feature. This unauthenticated SQL injection flaw allows an attacker to manipulate database queries, potentially leading to unauthorized access to sensitive information or disruption of services.

No authentication required to attack.
SQL injection in product search feature.
Database compromise or service disruption.

Live Threat

Current exploitation, exposure, and threat context

This unauthenticated SQL injection vulnerability could allow an attacker to interfere with how the Advance Product Search plugin processes search queries. When supported, this could lead to unauthorized access to sensitive database information.

Database information.
Via crafted search queries.
Unauthorized data disclosure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated SQL injection vulnerability in the Advance Product Search plugin requires immediate attention. The primary step is to identify all instances of this plugin across your environment. Once located, assess their reachability and business criticality to prioritize remediation efforts. Collaboration between application owners, platform teams, and potentially vendor-management will be crucial for a coordinated response.

Ownership: Application and platform teams.
Verify: Plugin reachability and business impact.
Action: Plan and execute targeted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Advance Product Search plugin?

Advance Product Search is a WordPress plugin designed to add enhanced search capabilities to e-commerce or content-heavy websites. It provides the backend logic that processes search queries typed by visitors into a site's search bar, allowing users to find specific products within a site's database more efficiently.

What does CVE-2026-56070 mean by SQL injection?

This vulnerability, classified as CWE-89, occurs when software fails to properly sanitize input before using it in a database query. In this case, the plugin allows an attacker to inject their own commands into the search function. Instead of just searching for products, the database processes the attacker's malicious instructions, potentially revealing restricted data or disrupting database operations.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending specially crafted search queries to the website that contain malicious code. Crucially, the vulnerability does not require the attacker to have an account or log in to the site. However, the flaw is specific to the plugin's search function; general browsing of static pages or interactions that do not involve the search feature will not trigger this specific issue.

Do I need to worry if my site uses this plugin?

Yes, you should evaluate the risk. According to Halo Surface Signal, this plugin is designed to be public-facing to enable user interaction, meaning it is inherently reachable from the internet. Because it is accessible to any visitor, the potential for unauthorized access via the search feature is significantly higher than for internal-only administrative tools.

What are the first steps to address this issue?

Begin by auditing your environment to identify every instance where the Advance Product Search plugin is installed. Once you have a complete inventory, determine which sites are internet-facing and assess the sensitivity of the data stored in the associated databases. Coordinate with your application and platform teams to prioritize these high-risk areas for remediation.

References

patchstack.com/database/wordpress/plugin/th-advance-product-search/v…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.