Product Filter by WBW
Product Filter for WooCommerce by WBW versions through 3.4.6 contain a critical unauthenticated blind SQL injection. Update to 3.4.7 or later and review frontend filter traffic.
Product Filter for WooCommerce by WBW versions through 3.4.6 contain a critical unauthenticated blind SQL injection vulnerability tracked as CVE-2026-112866. The plugin is installed on more than 50,000 WordPress sites. Patchstack disclosed the issue, and the vendor fixed it in version 3.4.7.
Vulnerability summary
- Plugin: Product Filter for WooCommerce by WBW
- Slug:
woo-product-filter - Affected versions: 3.4.6 and earlier
- Fixed version: 3.4.7
- CVE: CVE-2026-112866
- Severity: Critical, CVSS 3.1 score 9.3
- Attack class: Blind SQL injection (CWE-89)
- Privileges required: None
- User interaction: None
- Known exploitation: No confirmed in-the-wild exploitation was identified in the reviewed sources
Exploit path and impact
The vulnerability is reachable through unauthenticated frontend product-filter functionality. The CVE record does not identify the exact parameter or request handler, so defenders should not rely on blocking a guessed parameter. The vendor’s 3.4.7 changelog says it restricted frontend product-query arguments, fixed SQL injection in product filters, and improved temporary-table and SQL-query handling.
Because this is blind SQL injection, an attacker may infer database information from differences in application behavior rather than receiving query results directly. The CVSS vector rates confidentiality impact as high and availability impact as low. No authentication or victim interaction is required.
Immediate remediation
- Update Product Filter for WooCommerce by WBW to version 3.4.7 or later.
- Purge page, object, and CDN caches after updating.
- If the update cannot be applied immediately, deactivate the plugin until a patched release can be installed.
- Review web access and WAF logs for unusual bursts of frontend filter requests, repeated requests with changing filter values, unexpected response delays, or database errors.
- If suspicious activity is found, rotate WordPress database credentials after investigating and check administrator accounts, plugin files, and recent database changes.
Verify the installed version
wp plugin get woo-product-filter --fields=name,status,version,update,update_version
wp plugin update woo-product-filter
wp cache flushAfter remediation, the installed version should be 3.4.7 or later. If the plugin is managed through a deployment system, verify the production filesystem and not only the package manifest.
Practical log review
Search the relevant time window for repeated requests to WooCommerce product-filter routes and correlate them with slow responses, PHP warnings, SQL errors, and database load. Do not treat a single filter request as an indicator of compromise; normal shoppers use the same public feature. Escalate patterns that combine automation-like request volume with errors or timing anomalies.
Sources
