CVE Intelligence
Analysis AI-assisted

CVE-2026-56070: Advance Product Search - Unauthenticated SQL Injection

CVE-2026-56070 describes an unauthenticated SQL injection in Advance Product Search versions up to and including 1.4.4, classified as CWE-89. The CNA audit@patchstack.com assigned a CVSS 3.1 base score of 9.3 (critical) with a network attack vector and no privileges or user interaction required. The record does not provide a fixed version or affected product list, and the CVE is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-56070 is an unauthenticated SQL injection vulnerability in Advance Product Search, affecting versions 1.4.4 and earlier according to the record. The weakness is classified as CWE-89 (SQL Injection). The Patchstack advisory path indicates a WordPress plugin, which suggests the product is a WordPress plugin; this is an inference from the URL.

Impact

  • Confidentiality: the CVSS vector reports a high confidentiality impact.
  • Integrity: the CVSS vector reports no integrity impact.
  • Availability: the CVSS vector reports a low availability impact.
  • Because no authentication is required, a remote party able to reach the vulnerable functionality may be able to attempt exploitation. This is an inference from the network and no-privileges metrics.

Affected products and versions

  • Product: Advance Product Search.
  • Range stated in the record: versions less than or equal to 1.4.4.
  • The record's affected list is empty, so exact package identifiers and the lowest affected version are unknown.

Exploitation status

The record shows that this CVE is not listed in the CISA KEV catalog. No confirmed active exploitation appears in the sources consulted. The EPSS probability is 0.004 (percentile 0.32424), which is a statistical estimate and not evidence of exploitation.

Remediation and mitigation

  • Check the Patchstack advisory and vendor channels for a fixed version newer than 1.4.4, since the record does not state one.
  • Until a fix is verified, consider deactivating the plugin if it is not essential, and restrict public access to its search features where feasible.
  • Apply web application firewall rules for SQL injection protection on the affected plugin, if your provider offers them.
  • Limit the database account used by the website to the minimum privileges required.
  • Keep current backups and verify that restoration procedures work.

Detection guidance

  • Review web server and application logs for unusual requests to the plugin's search features, such as abnormal parameter lengths or database error messages returned to clients.
  • Monitor for unexpected database errors, new administrative accounts, or unplanned content changes.
  • Correlate findings with WAF logs if a web application firewall is in place.

Limitations of the available information

  • The record does not list affected versions beyond the stated range, fixed versions, vendor product details, or the vulnerable parameter.
  • The source status is Deferred, so the record may change.
  • The CVSS score is provided by the CNA audit@patchstack.com; the record does not show a separate NVD-assigned score.
  • Patch availability is unknown.

Frequently asked questions

What is CVE-2026-56070?

It is an unauthenticated SQL injection vulnerability in Advance Product Search, affecting versions less than or equal to 1.4.4, classified as CWE-89.

Is this vulnerability known to be actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted. The EPSS value is 0.004.

Is there a fixed version?

The record does not list a fixed version. Check the Patchstack advisory and the vendor for updates beyond 1.4.4.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.