CVE-2026-3396: 
WordPress vulnerability analysis and mitigation

CVE-2026-3396 is a time-based SQL Injection vulnerability in the WCAPF – WooCommerce Ajax Product Filter WordPress plugin, affecting all versions up to and including 4.2.3. The flaw exists in the post-author parameter due to insufficient escaping of user-supplied input and inadequate SQL query preparation, enabling unauthenticated attackers to extract sensitive data from the database. It was disclosed on April 8, 2026, by Wordfence, and carries a CVSS v3.1 base score of 7.5 (High) (Wordfence, Github Advisory).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The post-author parameter processed by the plugin's class-wcapf-product-filter.php file (notably at lines L65, L81, L689, and L739) is not properly escaped or parameterized before being incorporated into SQL queries, allowing attackers to append malicious SQL via time-based blind injection techniques. No authentication or user interaction is required, and the attack is conducted entirely over the network. The patch was applied in changeset 3484080 of the WordPress plugin repository (Wordfence, WordPress Trac).

Successful exploitation allows unauthenticated remote attackers to extract sensitive information from the WordPress database, potentially including customer personally identifiable information (PII), order data, hashed credentials, and other confidential WooCommerce records. The impact is limited to confidentiality — integrity and availability are not directly affected by this vulnerability. However, extracted credentials or session tokens could enable further account takeover or lateral movement within the WordPress environment (Wordfence, Github Advisory).

As of the time of disclosure, no public proof-of-concept exploit code has been confirmed, and there is no evidence of active in-the-wild exploitation (Feedly). However, a Nuclei detection template for this CVE was added to the ProjectDiscovery nuclei-templates repository (commits in April–May 2026), indicating automated scanning capability exists (Nuclei Templates). The EPSS score reported by the GitHub Advisory Database is approximately 22.856% (96th percentile), suggesting a relatively elevated probability of exploitation within 30 days despite no confirmed active exploitation. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify WordPress sites running the WCAPF – WooCommerce Ajax Product Filter plugin version ≤ 4.2.3 using tools like WPScan, Shodan, or Google dorks (e.g., inurl:/wp-content/plugins/wc-ajax-product-filter).
2. Identify vulnerable endpoint: Locate the AJAX product filter endpoint that processes the post-author parameter, typically triggered via a WooCommerce product listing or filter widget on the site's frontend.
3. Craft time-based SQL injection payload: Inject a time-based blind SQL payload into the post-author parameter, such as appending AND SLEEP(5)-- or equivalent, to confirm the injection point by observing delayed server responses.
4. Extract database content: Use automated tools like sqlmap with the identified parameter and endpoint to enumerate databases, tables, and extract sensitive data (e.g., sqlmap -u 'https://target.com/?post-author=1' --dbms=mysql --technique=T --dump).
5. Exfiltrate sensitive data: Target WordPress core tables (e.g., wp_users, wp_usermeta) and WooCommerce tables (e.g., wp_woocommerce_order_items) to extract credentials, customer PII, and order information (Wordfence, WordPress Trac).

• Network: Unusual HTTP requests to WooCommerce filter endpoints containing SQL keywords (SLEEP, BENCHMARK, AND 1=1, UNION SELECT) in the post-author parameter; repeated requests with incrementally varying payloads from a single IP.
• Logs: WordPress or web server access logs showing requests to AJAX filter endpoints (e.g., /?wc-ajax=wcapf_* or similar) with anomalous post-author values; elevated response times (>5 seconds) on filter requests indicating time-based injection.
• Database: Unexpected or unauthorized database queries logged in MySQL slow query logs involving SLEEP() or BENCHMARK() functions originating from the WordPress application user.
• File System: Presence of Nuclei scan artifacts or automated scanner user-agent strings (e.g., Nuclei) in web server logs targeting the plugin's endpoints.

Update the WCAPF – WooCommerce Ajax Product Filter plugin to a version newer than 4.2.3, which includes the fix applied in WordPress plugin repository changeset 3484080. If an immediate update is not possible, consider temporarily deactivating or removing the plugin to eliminate the attack surface. Additionally, deploying a Web Application Firewall (WAF) with SQL injection rules can provide interim protection. Review database access logs for suspicious time-delayed query patterns that may indicate prior exploitation (Wordfence, WordPress Trac).

Wordfence, the CNA that assigned and disclosed this CVE, included it in their weekly WordPress vulnerability report for April 6–12, 2026 (Wordfence Blog). Social media accounts such as RedPacketSecurity and CVE-focused Bluesky/Mastodon bots shared the disclosure shortly after publication, reflecting routine community tracking of WordPress plugin vulnerabilities. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability aggregation.