Live › vulnerability › CVE-2026-112866
Go to dashboardProduct Filter by WBW, a WooCommerce plugin from WPFactory, does not neutralize input used in an SQL query, so it allows blind SQL injection. An attacker can read data from the site's database one inference at a time.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 08:47 UTC. All times on this page are UTC.
Sites running the WordPress plugin Product Filter by WBW (woo-product-filter) at version 3.4.6 or earlier, typically WooCommerce stores that use its product filtering. Sites that do not have the plugin installed are not affected. The sources do not say whether the flaw needs a particular plugin setting.
No product ranges from the sources yet.
wp plugin get woo-product-filter --field=versionwoo-product-filter exists on the serverwoo-product-filter to a version later than 3.4.6, as the sources say the flaw runs through 3.4.6Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-112866")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.