CVE-2026-3396

HighCVSS 7.5/10Last modified Jul 24, 2026

Description

WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable to time-based SQL Injection via the 'post-author' parameter in all versions up to, and including, 4.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
shamimmoeen	WCAPF – Ajax Product Filter for WooCommerce	<= 4.2.3

References

Timeline

Published: Apr 8, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-339602.8An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 1580, 1680, W920, W930, and W1000. . A m CVE-2026-339622.8An issue was discovered in Wi-Fi in Samsung Mobile Processor Exynos 850, 1280, 1330, 1380, 1480, 2400, W920, and W930. A malformed Netlink c CVE-2026-339637.5An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. A stack-based buffe CVE-2026-339646.4An issue was discovered in camera in Samsung Mobile Processor Exynos 1580 and 2500. An untrusted pointer dereference occurs when a malformed CVE-2026-339655.3An attacker may send a malicious IMS message to the target device, potentially leading to information exposure through the SIP message flow.CVE-2026-339662.8An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. An information Leak CVE-2026-339672.8An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. In the camera drive CVE-2026-339682.8An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. In the camera drive CVE-2026-339697.5In the NAS Authentication Request message decoding procedure, a missing lower bound check causes an infinite loop, leading to Denial of Serv CVE-2026-339703.5An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850, 1080, 2100, 1280, 2200, 1330 CVE-2026-339719.8In the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service cond CVE-2026-339729.8In the Exynos modem's IMS stack, Out of Bound access occurs due to improper validation.