SQL Injection Vulnerability in Product Filter Plugin for WordPress
CVE-2025-8416
7.5HIGH
What is CVE-2025-8416?
The Product Filter by WBW plugin for WordPress contains a vulnerability that allows unauthenticated attackers to exploit SQL injection through the 'filtersDataBackend' parameter. This flaw exists due to insufficient input sanitization of user-supplied data and inadequate preparation of SQL queries. Attackers can manipulate existing queries, potentially leading to unauthorized access to sensitive database information. All versions of the plugin up to and including 2.9.7 are impacted, making it essential for users to update promptly to safeguard against potential exploits.
Affected Version(s)
Product Filter by WBW * <= 2.9.7