A critical SQL injection vulnerability in the WCAPF WooCommerce plugin enables unauthenticated attackers to extract sensitive data from the underlying database.

The plugin fails to perform sufficient input sanitization or parameterization on the post-author parameter, which is processed during AJAX requests. This allows unauthenticated attackers to inject malicious SQL commands to manipulate database queries and exfiltrate information.

Successful exploitation of this vulnerability can lead to the unauthorized disclosure of sensitive business and customer information stored within the WordPress database. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to data confidentiality, potentially resulting in regulatory non-compliance and reputational damage.

Immediate Action: Upgrade the WCAPF – Ajax Product Filter for WooCommerce plugin to the latest available version that addresses the insecure parameter handling. If an official patch is not yet available, deactivate the plugin immediately to prevent exploitation.

Proactive Monitoring: Monitor server access logs for suspicious AJAX requests containing SQL syntax patterns or unusual time-based query delays.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the post-author parameter.

Public Exploit Available: No (only a Nuclei detection template exists).

This vulnerability represents a significant risk due to the lack of required authentication for exploitation. Security teams should prioritize the identification of all WordPress instances running the affected plugin and ensure they are updated to a secure version immediately. If updates cannot be applied, the plugin must be disabled until a verified fix is implemented to prevent potential data exfiltration.