CVE-2026-1426: 
WordPress vulnerability analysis and mitigation

CVE-2026-1426 is a PHP Object Injection vulnerability in the Advanced AJAX Product Filters plugin for WordPress (by BeRocket), affecting all versions up to and including 3.1.9.6. The flaw exists in the shortcode_check function within the plugin's Live Composer compatibility layer, where untrusted input is deserialized without validation. Exploitation requires the Live Composer plugin to also be installed and active, and the attacker must have at least Author-level authentication. It carries a CVSS v3.1 base score of 8.8 (High) (Feedly, Red Hat CVE). The vulnerability was published on February 18, 2026.

The root cause is classified as CWE-502 (Deserialization of Untrusted Data): the shortcode_check function in the Live Composer compatibility layer of the Advanced AJAX Product Filters plugin passes attacker-controlled input to PHP's unserialize() without sanitization, enabling PHP Object Injection (Feedly, CWE-502). The attack is delivered over the network with low complexity and requires no user interaction beyond the attacker holding Author-level (or higher) WordPress credentials. Critically, the vulnerable plugin itself contains no known POP (Property-Oriented Programming) gadget chain; actual exploitation depends on a compatible gadget chain being present in another installed plugin or theme on the same WordPress site (Feedly). No public proof-of-concept exploit code has been identified as of the time of reporting.

If a POP chain is available via another installed plugin or theme, an authenticated attacker with Author-level access or above could leverage the injected PHP object to delete arbitrary files, retrieve sensitive data, or execute arbitrary code on the server — resulting in full compromise of confidentiality, integrity, and availability (Feedly). In the absence of a compatible gadget chain, the vulnerability has no direct exploitable impact. Successful exploitation in a worst-case scenario could enable lateral movement within a hosting environment or exposure of sensitive WordPress database credentials and user data.

There is no public proof-of-concept exploit and no confirmed in-the-wild exploitation as of the reporting date (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.089% (0.000890), indicating a low probability of exploitation in the near term. Exploitation is further constrained by the requirement for Author-level authentication and the simultaneous presence of both the Live Composer plugin and a vulnerable POP chain in another plugin or theme (Feedly). The vulnerability was detected by Qualys (detection ID 530986) (Feedly).

1. Reconnaissance: Identify WordPress sites running the Advanced AJAX Product Filters plugin (version ≤ 3.1.9.6) with the Live Composer plugin also active. Tools like WPScan or Shodan can enumerate plugin versions on publicly accessible sites.
2. Obtain Author-level credentials: Acquire valid WordPress credentials with at least Author-level access via phishing, credential stuffing, or brute force against the WordPress login endpoint.
3. Identify a POP chain: Enumerate other installed plugins or themes on the target site and research whether any contain known PHP gadget chains compatible with unserialize() exploitation (e.g., using tools like PHPGGC to generate payloads).
4. Craft a malicious serialized payload: Using a known gadget chain from an installed plugin/theme, craft a serialized PHP object payload designed to trigger the desired action (e.g., file deletion, code execution, or data exfiltration) upon deserialization.
5. Inject the payload: Submit the crafted serialized payload through the vulnerable shortcode_check function in the Live Composer compatibility layer, exploiting the lack of input validation to trigger deserialization of the malicious object.
6. Achieve objective: Depending on the POP chain used, the attacker may execute arbitrary code, delete files, or exfiltrate sensitive data from the WordPress installation (Feedly, CWE-502).

• Logs: WordPress access logs showing unusual POST requests to shortcode-related endpoints from Author-level accounts; PHP error logs referencing unexpected object instantiation or unserialize() calls in the Advanced AJAX Product Filters plugin context.
• File System: Unexpected new files or modified files in the WordPress installation directory (e.g., web shells, modified wp-config.php); missing or deleted core WordPress files that may indicate a file-deletion gadget chain was triggered.
• Process: Unusual child processes spawned by the web server process (e.g., php, apache2, nginx) executing shell commands, network utilities (curl, wget), or scripting interpreters.
• Network: Unexpected outbound connections from the web server to external IPs, particularly on non-standard ports, which may indicate a reverse shell or data exfiltration attempt.

No patch has been released for the Advanced AJAX Product Filters plugin as of the reporting date (Feedly). Immediate mitigations include: (1) deactivating and removing the Advanced AJAX Product Filters plugin if it is not essential; (2) disabling the Live Composer plugin, as the vulnerability requires both plugins to be active simultaneously; (3) auditing all installed plugins and themes for known POP chain gadgets and removing or updating any with known vulnerabilities; (4) restricting Author-level and above WordPress privileges to only fully trusted users; and (5) deploying a Web Application Firewall (WAF) to detect and block suspicious serialized payloads. Monitor the plugin's repository for security updates and apply them immediately upon release (Feedly, Wordfence).

Wordfence included CVE-2026-1426 in its weekly WordPress vulnerability report for the period of February 16–22, 2026, highlighting it as a notable finding for WordPress site administrators (Wordfence). Social media accounts such as RedPacketSecurity and TheHackerWire shared brief notifications about the CVE on Mastodon and Bluesky shortly after publication (Feedly). Community reaction has been measured, reflecting the conditional nature of the vulnerability's exploitability and the absence of a public exploit or active in-the-wild attacks.