This vulnerability (CVE-2026-56070) involves improper neutralization of special elements used in SQL commands (CWE-89) in the ThemeHunk Advance Product Search plugin. Versions up to 1.4.4 are affected by an unauthenticated SQL injection issue, allowing attackers to execute arbitrary SQL queries remotely without any privileges or user interaction. The CVSS 3.1 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. There is no vendor advisory or patch available at this time.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database (high confidentiality impact) and may cause limited disruption to service availability. Integrity is not impacted according to the CVSS vector. The vulnerability is exploitable remotely without authentication or user interaction, increasing the risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the affected plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.