What is the CVSS score of CVE-2025-8416?

CVE-2025-8416 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of WBW Product Filter are affected by CVE-2025-8416?

Product Filter by WBW (woo-product-filter) versions up to and including 2.9.7 expose any public-facing WordPress site to an unauthenticated SQL injection, allowing an attacker with only network…

How to fix or mitigate CVE-2025-8416?

Within 24 hours, inventory every WordPress instance, including staging and agency-managed sites, to determine which run Product Filter by WBW (woo-product-filter) at version 2.9.7 or earlier; deactivate and remove the plugin from any site where it is not business-critical, and for sites where it must remain active, deploy WAF rules or a virtual patch that blocks or sanitizes requests carrying the 'filtersDataBackend' parameter and enable detailed logging of those requests. Within 7 days, confirm remediation has propagated through all environments, CDN and page caches, verify no instance still reports a vulnerable version, review web and database logs for anomalous query activity or signs of data exfiltration on the affected endpoints, and consult the vendor's advisory page for any interim guidance or updated release. Within 30 days, monitor the vendor for a fixed release above 2.9.7 and apply Vendor-released patch as soon as it is published, evaluate a maintained alternative filtering plugin if no fix materializes, and if compromise is suspected rotate database credentials, WordPress salts, and any secrets stored on the affected hosts; finally, fold WordPress plugin version tracking into the routine vulnerability management cadence so future advisories of this class are detected automatically.

WBW Product Filter CVE-2025-8416

HIGH

SQL Injection (CWE-89)

2025-10-25 security@wordfence.com

WordPress SQLi Woocommerce Wordpress Plugin

7.5

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated remote SQL injection via an HTTP parameter (AV:N/AC:L/PR:N/UI:N); description limits impact to data extraction, so C:H with I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Metadata Corrected

Oct 08, 2026 - 12:40 vuln.today

tag: Woocommerce added

Analysis Generated

Oct 08, 2026 - 11:57 vuln.today

CVE Published

Oct 25, 2025 - 07:15 cve.org

HIGH 7.5

DescriptionCVE.org

The Product Filter by WBW plugin for WordPress is vulnerable to SQL Injection via the 'filtersDataBackend' parameter in all versions up to, and including, 2.9.7. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

Unauthenticated SQL injection in the WordPress plugin Product Filter by WBW (slug woo-product-filter) affects all versions up to and including 2.9.7, allowing remote attackers to inject arbitrary SQL through the 'filtersDataBackend' parameter and read sensitive data from the site's database. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation requires no authentication, no privileges, and no user interaction - any public-facing WordPress site with the vulnerable plugin active is directly exposed, with confidentiality impact rated High and no integrity or availability impact. There is no public exploit code identified at time of analysis and the plugin is not listed in CISA KEV; EPSS is low at 0.39% (31st percentile), but given the trivial unauthenticated access path this remains a genuine, actionable priority for any site running the affected plugin.

Technical ContextAI

The vulnerability is a classic CWE-89 SQL injection in a WordPress/WooCommerce product-filtering plugin. The plugin's filter backend builds SQL statements from user-supplied input without parameterization and without adequate escaping; the referenced code paths (modules/woofilters/mod.php around line 2056 and modules/woofilters/controller.php line 136 in tag 2.8.6) show where the 'filtersDataBackend' parameter is consumed and concatenated into an existing query. Because the input lands in a query that is neither prepared nor escaped, an attacker can append additional SQL fragments (for example via UNION or boolean/stacked constructs) to the legitimate filter query. The parameter is reachable through the plugin's front-end filter-handling path, which is designed to be available to anonymous store visitors - this is why the CVSS vector carries PR:N/UI:N and why no non-default setting is required. The result is extraction of arbitrary data from the WordPress database (user hashes, options, customer/order data, secrets stored in wp_options), limited to read (C:H, I:N, A:N) - there is no evidence of file write or code execution in the assessed impact. Affected component: WordPress plugin 'Product Filter by WBW' / woo-product-filter, version 2.9.7 and earlier.

Affected ProductsAI

The affected product is the WordPress plugin 'Product Filter by WBW' with slug woo-product-filter, in all versions up to and including 2.9.7 (the vendor trac references examined in the source data include tag 2.8.6). No CPE string was provided in the input data, so the CPE cannot be stated authoritatively; the plugin is installed on WordPress sites, typically alongside WooCommerce where product filtering is used. The authoritative affected-version statement and advisory is the Wordfence threat-intel entry at https://www.wordfence.com/threat-intel/vulnerabilities/id/d1533e9a-dcb9-4fbb-a1a7-7f4dafd3a1c8?source=cve, with the underlying code visible in the WordPress plugin repository at https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/2.8.6/modules/woofilters/controller.php#L136 and https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/2.8.6/modules/woofilters/mod.php#L2056.

RemediationAI

No vendor-released patched version is confirmed in the provided data; however, the referenced repository changeset (https://plugins.trac.wordpress.org/changeset?old=3370655%40woo-product-filter&new=3370655%40woo-product-filter) indicates an upstream fix commit is available in the plugin's trac, so treat this as 'upstream fix available (changeset); released patched version not independently confirmed' and update the woo-product-filter plugin as soon as a tagged release newer than 2.9.7 appears, verifying the version against the Wordfence advisory above. If an update cannot be applied immediately, the most effective compensating control is to deactivate and remove the plugin altogether - this fully closes the exposure but removes all product-filtering functionality from the storefront. If filtering must remain live, front-end filtering requests carrying a 'filtersDataBackend' parameter should be inspected and blocked by a WAF rule that rejects requests containing SQL metacharacters (quotes, comment sequences, UNION/SELECT keywords) in that parameter; the trade-off is that the plugin is not a first-class WAF signature target and legitimate filter payloads can be complex, so false positives and rule-bypass risk are real and this is a stopgap, not a fix. Monitoring database-facing logs for anomalous query patterns from the filter endpoint and rotating database credentials and salts after any suspected exploitation are prudent follow-ups. Given every public-facing site running <= 2.9.7 is exploitable without authentication, patching or plugin removal should be treated as time-sensitive.