CVE-2026-112866
CriticalCVSS 9.3Summary
The WordPress plugin Product Filter by WBW (woo-product-filter) up to version 3.4.6 is vulnerable to blind SQL injection due to improper neutralization of special elements in SQL commands. An attacker could exploit this to manipulate database queries.
Risk Assessment
The vulnerability could allow an attacker to extract sensitive information from the database or modify data. It may also lead to further attacks such as privilege escalation.
Recommendation
Update the Product Filter by WBW plugin to the latest version (above 3.4.6). If updating is not possible, consider disabling the plugin and implementing WAF rules.
Other vulnerabilities in Product Filter by WBW
See all- CVE-2026-95601Critical
Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.
- CVE-2026-39494Critical
The SQL Injection vulnerability in the Product Filter by WBW allows for Blind SQL Injection attacks. This issue affects versions from n/a through 3.1.2.
- CVE-2025-11269Medium
The Product Filter by WBW plugin for WordPress (all versions up to and including 3.0.0) is vulnerable to unauthorized data modification due to a missing capability check on the 'approveNotice' action. An unauthenticated attacker can update the plugin's settings.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS