Cyber Resilience

CVE-2026-3396

High

Published: 08 April 2026

Published
08 April 2026
Modified
24 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.2286 96.0th percentile
Risk Priority 29 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-3396 is a high-severity SQL Injection (CWE-89) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 4.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

The WCAPF – WooCommerce Ajax Product Filter plugin for WordPress is vulnerable to time-based SQL injection in all versions through 4.2.3. The flaw exists in handling of the 'post-author' parameter, where insufficient escaping of user input and missing prepared-statement protections allow an attacker to alter existing SQL queries, as tracked under CWE-89 with a CVSS 7.5 rating.

Unauthenticated remote attackers can supply crafted input to the affected parameter and append additional queries, enabling extraction of sensitive database contents without any user interaction or credentials.

The referenced plugin source files and changeset 3484080 on WordPress Trac document the locations of the vulnerable code and the corresponding fix, indicating that updating to a patched release resolves the issue. The associated EPSS score has remained flat at 0.2286 with no material increase observed.

EU & UK References

Vulnerability details

WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable to time-based SQL Injection via the 'post-author' parameter in all versions up to, and including, 4.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on…

more

the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

The time-based SQL injection in a public-facing WordPress plugin directly enables remote exploitation of public-facing applications (T1190) and facilitates unauthorized collection of data from the database (T1213.006) such as user credentials.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2019-25537Shared CWE-89
CVE-2019-25366Shared CWE-89
CVE-2019-25496Shared CWE-89
CVE-2026-1475Shared CWE-89
CVE-2026-26990Shared CWE-89
CVE-2026-44047Shared CWE-89
CVE-2025-12865Shared CWE-89
CVE-2024-11135Shared CWE-89
CVE-2019-25491Shared CWE-89
CVE-2024-13369Shared CWE-89

Affected Assets

Wordpress
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Enforces validation of user-supplied parameters like 'post-author' to prevent time-based SQL injection by blocking malicious SQL payloads before database execution.

SI-2 Flaw Remediation good match
prevent

Requires timely remediation of the identified SQL injection flaw in WCAPF plugin versions up to 4.2.3 through patching as indicated in changeset 3484080.

RA-5 Vulnerability Monitoring and Scanning good match
preventdetect

Monitors and scans for vulnerabilities like this time-based SQL injection, enabling timely detection and remediation to prevent exploitation.

References