---
id: "CVE-2026-112866"
kind: "vulnerability"
aliases: ["CVE-2026-112866"]
title: "WordPress Product Filter by WBW: blind SQL injection exposes the site database"
severity: "critical"
cvss: 9.3
epss: 0.004
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "woo-product-filter", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-24T08:16:51+00:00"
first_seen_at: "2026-10-24T08:47:15+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112866", "first_seen_at": "2026-10-24T08:47:15+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-112866", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# WordPress Product Filter by WBW: blind SQL injection exposes the site database

Product Filter by WBW, a WooCommerce plugin from WPFactory, does not neutralize input used in an SQL query, so it allows blind SQL injection. An attacker can read data from the site's database one inference at a time.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get woo-product-filter --field=version`
- Confirm whether the plugin folder `woo-product-filter` exists on the server

## Fix

- Update the plugin `woo-product-filter` to a version later than `3.4.6`, as the sources say the flaw runs through `3.4.6`
- If no fixed version is available, deactivate the plugin until one is released (unknown from sources)

## Timeline

- 2026-10-24T08:47:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112866
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-112866

## From the sources

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_