CVE-2026-12753 describes a SQL Injection vulnerability in the themehunk Advance Product Search- Voice & Ajax Search for WooCommerce plugin for WordPress. The issue arises from improper neutralization of special elements in SQL commands (CWE-89) via the 's' and 'match' parameters. These parameters are not properly escaped or prepared before being used in SQL queries, enabling unauthenticated attackers to append malicious SQL code. This can be exploited to extract sensitive information from the underlying database. The vulnerability affects all plugin versions up to and including 1.4.4. There is no vendor advisory or patch available at this time.

Successful exploitation allows unauthenticated attackers to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not impact integrity or availability directly but compromises confidentiality. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality with network attack vector and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitoring for updates from the vendor or trusted security sources is recommended.