The WCAPF – Ajax Product Filter plugin for WooCommerce contains a gateway that does not properly escape the user supplied 'post-author' parameter, allowing a time‑based SQL injection to be injected into the underlying database query. This weakness, identified as CWE‑89, permits an attacker to append arbitrary SQL that can probe and extract sensitive information from the database. As the vulnerability is exploitable by unauthenticated users and can reveal confidential data, it represents a serious threat to the confidentiality and integrity of the site’s data.

The vulnerability affects the WCAPF – Ajax Product Filter for WooCommerce plugin released by shamimmoeen. All installed instances of the plugin with a version number of 4.2.3 or earlier are susceptible. Any WordPress site that has not upgraded beyond this version is at risk.

The CVSS score of 7.5 classifies the flaw as high severity. While an EPSS score is not available and it is not listed in the KEV database, the fact that it is unauthenticated and leverages a time‑based technique implies an attacker can probe the database without detection by forcing delay responses. The likely attack vector is the AJAX product filter endpoint, where the 'post-author' parameter is passed directly to the database. Exploitation requires only sending a crafted HTTP request; no additional privileges are necessary.