What’s Vulnerable › Vulnerabilities
CVE-2026-112866: WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability
- Severity: critical (CVSS 9.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-24 · updated 2026-10-26
- Weakness: CWE-89
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.
Summary
The WordPress plugin Product Filter by WBW (woo-product-filter) from WPFactory contains a blind SQL injection flaw caused by improper neutralization of special elements in SQL commands. Versions from n/a through 3.4.6 are affected, and the vulnerability is rated critical (CVSS 9.3), potentially allowing attackers to extract database contents. It is not listed in CISA KEV, CISA SSVC reports no known exploitation, and EPSS estimates a 0.4% chance of exploitation in 30 days. Update the plugin to a version later than 3.4.6 once available; if no fix exists, disable or remove the plugin until a patched release is issued.
تحتوي إضافة WordPress المسماة Product Filter by WBW (woo-product-filter) من WPFactory على ثغرة حقن SQL أعمى ناتجة عن عدم تحييد العناصر الخاصة في أوامر SQL بشكل صحيح. تتأثر الإصدارات من n/a حتى 3.4.6، وتصنَّف الثغرة حرجة (CVSS 9.3) وقد تتيح للمهاجمين استخراج محتويات قاعدة البيانات. لا ترد الثغرة في CISA KEV، ولا تشير CISA SSVC إلى أي استغلال معروف، ويقدّر EPSS احتمال الاستغلال خلال 30 يوماً بنسبة 0.4%. يُنصح بالترقية إلى إصدار أحدث من 3.4.6 فور توفره، وإذا لم يتوفر إصلاح فيجب تعطيل الإضافة أو إزالتها حتى صدور نسخة مصححة.
Affected products
- WPFactory Product Filter by WBW: through 3.4.6
References
Get alerted when CVE-2026-112866 or the next vulnerability affects your stack