SQL injection vulnerability in Product Filter by WBW

WordPress

What happened

A serious SQL injection vulnerability has been identified in the Woo Product Filter for WordPress, which could allow unauthorized access to sensitive data.

Are you affected?

Users of the Product Filter by WBW plugin for WordPress may be affected if they are using versions 3.4.6 or earlier.

What to do now

1. Upgrade to a fixed version of the plugin when available.
2. Regularly monitor the official advisory for updates.
3. Review your system for potential signs of exploitation.

Sources

• cve.now/CVE-2026-112866
• cve.now/GHSA-3pqj-4593-j73m
• CVE-2026-112866
• GHSA-3pqj-4593-j73m
• https://nvd.nist.gov/vuln/detail/CVE-2026-112866
• https://patchstack.com/database/wordpress/plugin/woo-product-filter/vulnerability/wordpress-product-filter-by-wbw-plugin-3-4-6-sql-injection-vulnerability?_s_id=cve
• cve.now/GHSA-3PQJ-4593-J73M
• GHSA-3PQJ-4593-J73M
• https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-112866.yaml
• https://github.com/Hassham1/CVE-2026-112866-woo-product-filter-sqli-poc

Data sources: cve.now, CISA KEV, GitHub Advisory Database, OSV.

This product uses data from the NVD API but is not endorsed or certified by the NVD.