Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Product Filter by WBW plugin can let attackers query database

CVE-2026-112866 · published 11 days ago
Summary

The Product Filter by WBW extension for WordPress (versions up to 3.4.6) does not properly check data it receives, allowing an attacker to inject hidden database commands. This could let an attacker view or change information stored in your site’s database. Update the plugin to a newer version or remove it if you cannot apply the fix.

What to do
  • Update wpfactory product filter by wbw to version 3.4.7.
Affected software
VendorProductAffected versions
wpfactory product filter by wbw <= 3.4.6
Fix: upgrade to 3.4.7
Original advisory text
WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.3 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published24 Oct 2026
Updated3 Nov 2026
First seen24 Oct 2026
Sources
CVE-2026-112866 · NVD
CVE-2026-112866 · MITRE
Track software like this
Free during beta