{"id":"CVE-2026-112866","kind":"vulnerability","aliases":["CVE-2026-112866"],"related":[],"title":"WordPress Product Filter by WBW: blind SQL injection exposes the site database","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.","summary":"Product Filter by WBW, a WooCommerce plugin from WPFactory, does not neutralize input used in an SQL query, so it allows blind SQL injection. An attacker can read data from the site's database one inference at a time.","severity":"critical","cvss":9.3,"epss":0.004,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","woo-product-filter","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get woo-product-filter --field=version`\n- Confirm whether the plugin folder `woo-product-filter` exists on the server","fix":"- Update the plugin `woo-product-filter` to a version later than `3.4.6`, as the sources say the flaw runs through `3.4.6`\n- If no fixed version is available, deactivate the plugin until one is released (unknown from sources)","status":"open","published_at":"2026-10-24T08:16:51+00:00","first_seen_at":"2026-10-24T08:47:15+00:00","triaged_at":"2026-10-25T02:59:44+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T02:59:44Z","model":"claude-haiku-5-5","output":{"fix":"- Update the plugin `woo-product-filter` to a version later than `3.4.6`, as the sources say the flaw runs through `3.4.6`\n- If no fixed version is available, deactivate the plugin until one is released (unknown from sources)","reach":"internet","title":"WordPress Product Filter by WBW: blind SQL injection exposes the site database","impact":"high","summary":"Product Filter by WBW, a WooCommerce plugin from WPFactory, does not neutralize input used in an SQL query, so it allows blind SQL injection. An attacker can read data from the site's database one inference at a time.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","woo-product-filter","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads the site database, including user and order data","analyst_note":"Confirm the fixed version and whether unauthenticated requests reach the vulnerable query; check the NVD entry and the WPFactory changelog.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get woo-product-filter --field=version`\n- Confirm whether the plugin folder `woo-product-filter` exists on the server","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WordPress plugin Product Filter by WBW (woo-product-filter) at version 3.4.6 or earlier, typically WooCommerce stores that use its product filtering. Sites that do not have the plugin installed are not affected. The sources do not say whether the flaw needs a particular plugin setting.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000638,"input_tokens":3320,"output_tokens":613,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-112866':15A,18A '-2026':14A,17A '3.4.6':104C 'affect':96C 'allow':49B,91C 'attack':54B 'blind':6A,50B,92C 'command':77C 'cve':13A,16A 'data':57B 'databas':12A,62B 'element':72C 'expos':9A 'filter':3A,26B,30B,84C,90C,98C 'host':22B 'improp':68C 'infer':64B 'inject':8A,52B,79C 'injection.this':94C 'input':41B 'issu':95C 'n/a':102C 'neutral':40B,69C 'one':63B 'packag':19B 'plugin':35B 'product':2A,25B,29B,83C,89C,97C 'queri':46B 'read':56B 'self':21B 'self-host':20B 'site':11A,60B 'special':71C 'sql':7A,45B,51B,76C,78C,93C 'time':67B 'use':42B,73C 'vulner':80C 'wbw':5A,32B,86C,100C 'woo':24B,88C 'woo-product-filt':23B,87C 'woocommerc':27B,34B 'wordpress':1A,28B 'wpfactori':37B,82C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WordPress plugin Product Filter by WBW (woo-product-filter) at version 3.4.6 or earlier, typically WooCommerce stores that use its product filtering. Sites that do not have the plugin installed are not affected. The sources do not say whether the flaw needs a particular plugin setting.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T08:16:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112866","severity":null,"published_at":"2026-10-24T08:16:51+00:00","modified_at":"2026-10-24T08:16:51+00:00","first_seen_at":"2026-10-24T08:47:15+00:00","fetched_at":"2026-10-24T08:47:15+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112866","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112866","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}