CVE-2026-1426
PHP Object Injection in Advanced AJAX Product Filters Plugin
Publication date: 2026-02-18
Last updated on: 2026-02-18
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| advanced_ajax_product_filters | advanced_ajax_product_filters | to 3.1.9.6 (inc) |
| berocket | advanced_ajax_product_filters | to 3.1.9.6 (inc) |
| berocket | woocommerce_ajax_filters | 3.1.9.7 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Advanced AJAX Product Filters plugin for WordPress has a vulnerability called PHP Object Injection in all versions up to 3.1.9.6. This happens because the plugin deserializes untrusted input in the shortcode_check function within the Live Composer compatibility layer. Authenticated attackers with Author-level access or higher can exploit this to inject malicious PHP objects.
However, this vulnerability only has an impact if another plugin or theme containing a POP (Property Oriented Programming) chain is installed on the site, as no known POP chain exists in the vulnerable plugin itself. If such a POP chain is present, attackers could potentially delete files, retrieve sensitive data, or execute arbitrary code.
Additionally, the Live Composer plugin must be installed and active for this vulnerability to be exploitable.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker with Author-level access or higher to inject malicious PHP objects via deserialization. The impact depends on the presence of a POP chain in other installed plugins or themes.
- Delete arbitrary files on the server.
- Retrieve sensitive data from the system.
- Execute arbitrary code, potentially leading to full system compromise.
Without a POP chain in other plugins or themes, this vulnerability has no direct impact.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves PHP Object Injection via deserialization of untrusted input in the shortcode_check function within the Live Composer compatibility layer of the Advanced AJAX Product Filters plugin for WordPress. Detection would involve monitoring for suspicious or unauthorized use of this shortcode or abnormal shortcode processing.
Since the vulnerability requires authenticated attackers with Author-level access or higher, detection should focus on monitoring authenticated user activities, especially those involving shortcode usage or Live Composer modules.
No explicit detection commands or network signatures are provided in the available resources.
General detection approaches could include:
- Review WordPress logs for unusual shortcode usage or unexpected POST requests involving the Live Composer plugin.
- Use WordPress security plugins or monitoring tools to audit changes or usage of the Advanced AJAX Product Filters and Live Composer plugins.
- Check for the presence of the vulnerable plugin versions (up to 3.1.9.6) and the Live Composer plugin active on the site.
Specific commands are not provided in the resources, so detection commands cannot be suggested from the given information.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability affects all versions of the Advanced AJAX Product Filters plugin up to and including 3.1.9.6. The immediate mitigation step is to update the plugin to a version that addresses the vulnerability.
Resource 1 describes the release of version 3.1.9.7 of the WooCommerce Ajax Filters plugin, which is a substantial update likely including fixes and improvements. Although it does not explicitly mention security fixes for CVE-2026-1426, upgrading to this latest version is recommended.
Additional mitigation steps include:
- Ensure the Live Composer plugin is either removed or disabled if it is not needed, as the vulnerability requires it to be active.
- Restrict Author-level access and above to trusted users only, since exploitation requires authenticated users with such privileges.
- Monitor and audit user activities related to shortcode usage and Live Composer modules.
- Consider applying additional security measures such as Web Application Firewalls (WAF) that can detect or block deserialization attacks.