CVE-2026-1426 is a PHP Object Injection vulnerability in the Advanced AJAX Product Filters plugin for WordPress, affecting all versions up to 3.1.9.6. The flaw exists in the shortcode_check function within the Live Composer compatibility layer, which deserializes untrusted input. Exploitation requires authenticated users with Author-level privileges or higher and the Live Composer plugin to be active. The vulnerability itself does not contain a POP chain, so it depends on the presence of another plugin or theme with a POP chain to enable code execution or other malicious actions. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and privileges required at the Author level.

If exploited in conjunction with a suitable POP chain from another plugin or theme, an attacker with Author-level access can potentially delete arbitrary files, retrieve sensitive information, or execute arbitrary code on the affected WordPress site. Without a POP chain, the vulnerability has no direct impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and consider disabling or removing the Live Composer plugin if not required. Monitor for updates from the plugin vendor regarding a security patch. No generic mitigations beyond these are specifically indicated.