Product Filter by WBW: Blind SQL injection

Summary

The Product Filter by WBW WooCommerce plugin from WPFactory contains a blind SQL injection flaw in versions up to and including 3.4.6. An unauthenticated remote attacker can send crafted requests to read, modify or delete data in the WordPress database, including user accounts and private customer data. Any internet-facing shop running an affected version is exposed; the CNA score is 9.3 (critical), while VulDB lists 7.3. Version 3.4.7 fixes the issue.

Affected

• WPFactory Product Filter by WBW (WordPress plugin slug woo-product-filter) up to and including 3.4.6
• The lower bound of the affected range is not stated; earlier versions are presumed affected but not confirmed.

Fixed in

• Version 3.4.7 or later (per Patchstack and the CNA).

Workaround

• No vendor workaround known.
• Patchstack has issued a mitigation rule (virtual patch) for its customers. This is not a vendor fix and does not replace the update.
• If the update cannot be applied immediately, consider temporarily disabling the plugin if the filter is not business-critical. This is a recommendation, not a documented vendor measure.

Exploitation

• Not listed in the CISA KEV catalog; no confirmed exploitation in the wild.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• Patchstack describes the vulnerability as highly dangerous and expected to be exploited.
• A public GitHub repository claims a reproduction on 3.4.6. Its contents were not verified; treat it as a proof of concept in public circulation.

Our recommendation

• Check whether the plugin is installed and which version is active, especially on WooCommerce shops.
• Update to version 3.4.7 or later immediately.
• Check web server and WordPress logs for anomalous filter or AJAX requests, both before and after the update.
• Review database user accounts and admin accounts after updating, and reset credentials if there are signs of misuse.
• Monitor for further exploit activity and keep the plugin updated.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  Hassham1/CVE-2026-112866-woo-product-filter-sqli-poc

Research sources

• Patchstack advisory patchstack.com
• WordPress.org plugin page wordpress.org
• VulDB entry vuldb.com
• OpenCVE (CNA data, SSVC) app.opencve.io
• TheHackerWire (PoC and KEV status) www.thehackerwire.com
• GitHub proof-of-concept repository (unverified) github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:45.