Exploitation Research Plan: CVE-2026-32457

1. Vulnerability Summary

The Advanced Product Fields (Product Addons) for WooCommerce plugin (<= 1.6.18) contains a missing authorization vulnerability. The Admin_Controller registers several AJAX actions intended for administrative product and term searching. These actions, specifically wapf_search_products, wapf_search_tags, wapf_search_cat, and wapf_search_variations, are registered without sufficient capability checks in the handler functions. Furthermore, if these are registered as nopriv (unauthenticated) to support frontend features like "Child Product" selection, they allow unauthenticated users to query potentially sensitive product data.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N suggests a Low Integrity impact. This indicates the vulnerability allows an unauthorized action that modifies state, such as duplicating field groups via the maybe_duplicate method if it is triggered without a capability check during an early hook like admin_init.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php (AJAX) or /wp-admin/admin-post.php (for admin_init hooks).
• Vulnerable Actions:
  • wapf_search_products (AJAX)
  • `wap