Product Filter For Woocommerce By Wbw CVE-2026-3830

Product Filter for WooCommerce by WBW plugin versions before 3.1.3 installed and activated on WordPress site. Remote unauthenticated attacker can exploit via crafted HTTP request to vulnerable parameter. No victim interaction required. Default WordPress installations with this plugin are affected.

Real-world risk is HIGH despite the CVE year suggesting future designation (likely a typo for 2024/2025). The CVSS 8.6 score reflects critical Confidentiality impact (C:H) with Changed scope (S:C), indicating data breach potential beyond the plugin's immediate context. Attack vector is Network-based (AV:N) with Low complexity (AC:L) and no user interaction required (UI:N), making this trivially exploitable. The unauthenticated attack surface (PR:N) is the most concerning factor-any internet-facing WooCommerce site with this plugin installed is vulnerable without requiring any login. Publicly available exploit code dramatically lowers the skill barrier for mass exploitation. WooCommerce databases typically contain high-value data including customer PII, payment records, and admin credentials, making this an attractive target for credential stuffing, financial fraud, and data theft. The WordPress ecosystem's prevalence and automated scanning tools mean vulnerable instances will be rapidly identified and exploited. This should be treated as a critical-priority patch deployment, particularly for any e-commerce sites processing real transactions.

An unauthenticated attacker identifies a WooCommerce site running the vulnerable plugin by browsing to the product catalog and observing the filter interface. They craft a malicious HTTP request to the plugin's filter endpoint, injecting SQL commands into the unsanitized parameter, such as a UNION-based injection to extract wp_users table contents. The attacker retrieves administrator password hashes, customer email addresses, order histories, and payment metadata, which they then use for account takeover, credential stuffing attacks against other services, or sale on dark web marketplaces.