SQL Injection Vulnerability in WPFactory Woo Product Filter by WBW
CVE-2026-112866

9.3CRITICAL

Key Information:

Vendor

WordPress
Status
Product Filter By Wbw
Vendor
CVE Published:
24 October 2026

What is CVE-2026-112866?

The WPFactory Product Filter by WBW is susceptible to a SQL Injection vulnerability that allows for the execution of arbitrary SQL queries. This can lead to unauthorized data access or manipulation, compromising the integrity and confidentiality of the database. The issue is particularly concerning as it enables attackers to perform Blind SQL Injection, resulting in potential data leakage. Affected versions include all prior to 3.4.6, making it imperative for users to update to secure their applications.

Affected Version(s)

Product Filter by WBW 0 <= 3.4.6

References

https://patchstack.com/database/wordpress/plugin/woo-prod...
vdb-entry

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yuto Hyakumoto | Patchstack Bug Bounty Program
.