Introduction
An unauthenticated time-based SQL injection in the WCAPF WooCommerce Ajax Product Filter plugin lets remote attackers extract sensitive database contents from any affected WooCommerce store without logging in. The plugin has over 9,000 active installations, and the technical details are now public, so WooCommerce site operators need to address this promptly.
WCAPF (Ajax Product Filter for WooCommerce) is a WordPress plugin that adds AJAX-powered product filtering to WooCommerce storefronts. Customers use it to narrow product listings by attributes such as price, category, and author. It is not among the largest WooCommerce extensions, but 9,000+ active installations still means a meaningful number of e-commerce sites may be exposed. A single developer, Mainul Hassan, maintains the plugin, and it is listed on the official WordPress plugin repository.
Technical information
CVE-2026-3396 is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The root cause is simple. The plugin does not properly escape user-supplied input, and it does not use prepared statements when it builds SQL queries that include the post-author filter parameter.
Vulnerable code path
The vulnerability is in class-wcapf-product-filter.php. The plugin reads filter parameters by calling parse_str on the raw $_SERVER['QUERY_STRING'], which populates variables directly from the URL with no sanitization layer in between. When the filter_type is post-author, the extracted value reaches SQL query construction at several points in the file. The advisory references lines 65, 81, 689, and 739.
Because the value is neither escaped nor passed through WordPress's $wpdb->prepare() method, an attacker can inject arbitrary SQL fragments into the query.
Attack flow
An attack runs in four steps:
-
The attacker finds a WooCommerce site running WCAPF version 4.2.3 or earlier. Detecting the plugin is trivial with standard WordPress fingerprinting techniques.
-
The attacker sends an HTTP request to the site's product filter endpoint with a time-based blind SQL injection payload in the
post-authorquery string parameter. The request needs no authentication cookies or tokens. -
The plugin's
class-wcapf-product-filter.phpparses the query string and passes the taintedpost-authorvalue directly into a SQL query. The injected SQL is appended to the existing query and executed against the WordPress database. -
The attacker measures differences in response time, the hallmark of time-based blind SQLi, and can infer database contents one character at a time. Targets include the
wp_userstable (usernames, password hashes, email addresses), WooCommerce order tables (customer names, addresses, order details), and any other data stored in the WordPress database.
CVSS breakdown
The CVSS 3.1 score is 7.5, with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
| Metric | Value | Description |
|---|---|---|
| Attack Vector | Network | Exploitable remotely over the internet |
| Attack Complexity | Low | No specialized conditions required |
| Privileges Required | None | Unauthenticated exploitation |
| User Interaction | None | No victim interaction needed |
| Scope | Unchanged | Confined to the vulnerable component |
| Confidentiality | High | Full database extraction possible |
| Integrity | None | No direct data modification |
| Availability | None | No denial of service impact |
Confidentiality is the only impact the score records, and for e-commerce databases that hold customer PII and payment metadata, it is a serious one.
Affected systems and versions
All versions of the WCAPF (WooCommerce Ajax Product Filter) plugin up to and including version 4.2.3 are vulnerable. Version 4.3.0, released on March 16, 2026, patched the vulnerability. The latest available version at the time of writing is 4.4.0.
For quick reference:
- Vulnerable: WCAPF versions <= 4.2.3
- Patched: WCAPF version 4.3.0 and later
- Recommended: WCAPF version 4.4.0 (latest, includes additional escaping and coding standards improvements)
- Platform: WordPress sites running WooCommerce with the WCAPF plugin active
- Tested compatibility: WordPress up to version 6.9.4
Vendor security history
CVE-2026-3396 is the only cataloged vulnerability for the WCAPF plugin in the Wordfence threat intelligence database, which suggests a generally clean security record. The vendor handled this disclosure well. The patch in version 4.3.0 shipped about three weeks before Wordfence publicly disclosed the vulnerability on April 7, 2026, which points to responsible coordination between the researcher and the maintainer.
The plugin does still have a single maintainer. That is common in the WordPress ecosystem, and it warrants extra caution. Organizations that rely on single-maintainer plugins should have automated updates or monitoring in place.
References
- Wordfence Threat Intel: WCAPF <= 4.2.3 Unauthenticated Time-Based SQL Injection
- NVD Entry for CVE-2026-3396
- CVE Record: CVE-2026-3396
- Vulnerable Source: class-wcapf-product-filter.php (Line 65)
- Vulnerable Source: class-wcapf-product-filter.php (Line 81)
- Vulnerable Source: class-wcapf-product-filter.php (Line 689)
- Vulnerable Source: class-wcapf-product-filter.php (Line 739)
- WordPress Plugin Repository Changeset 3484080
- WCAPF Plugin Page on WordPress.org
- Developer Profile: Mainul Hassan (shamimmoeen)
- Wordfence: All Vulnerabilities for WCAPF
