The WCAPF – Ajax Product Filter plugin for WooCommerce contains a flaw where the user supplied 'post-author' parameter is not properly escaped in the SQL query. This vulnerability, coded as CWE‑89, permits time‑based SQL injection that can retrieve sensitive database information. Because the flaw is exploitable without authentication and relies only on sending a crafted HTTP request to the AJAX endpoint, it threatens the confidentiality and integrity of the site’s database contents.

The flaw affects the WCAPF – Ajax Product Filter plugin distributed by shamimmoeen. All WordPress sites running any version of the plugin up to and including 4.2.3 are vulnerable. Sites that have not upgraded beyond 4.2.3 remain at risk until a patch is applied.

With a CVSS score of 7.5 the vulnerability is classified as high severity. The EPSS score of 17% indicates a moderate likelihood of exploitation. It is not listed in the CISA KEV catalog, but the unauthenticated, time‑based nature of the attack makes it possible to probe the database without detection. The attack is likely to target the AJAX product filter endpoint by manipulating the 'post-author' parameter, and no additional privileges are required to succeed.