What is the CVSS score of CVE-2026-3830?

CVE-2026-3830 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3830?

Product Filter for WooCommerce by WBW plugin versions below 3.1.3 contains a critical SQL injection vulnerability allowing unauthenticated attackers to extract sensitive database contents including…. A patch is available.

Is there a public PoC exploit available for CVE-2026-3830?

Yes, a public proof-of-concept exploit is available for CVE-2026-3830. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-3830?

Within 24 hours: Identify all WooCommerce installations using Product Filter for WooCommerce by WBW and document current plugin version. Within 7 days: Update Product Filter for WooCommerce by WBW to version 3.1.3 or later on all affected installations; verify update completion and test critical e-commerce functions. Within 30 days: Conduct database integrity audit to identify potential unauthorized data access; review customer notification obligations under GDPR, CCPA, or applicable regulations if exploitation is suspected.

WordPress CVE-2026-3830

EUVD-2026-21881 HIGH

SQL Injection (CWE-89)

2026-04-13 WPScan

SQLi WordPress

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:57 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.1.3

PoC Detected

Apr 15, 2026 - 15:05 vuln.today

Public exploit code

Patch released

Apr 15, 2026 - 15:05 nvd

Patch available

Analysis Generated

Apr 13, 2026 - 13:23 vuln.today

CVSS changed

Apr 13, 2026 - 13:22 NVD

8.6 (HIGH)

EUVD ID Assigned

Apr 13, 2026 - 07:15 euvd

EUVD-2026-21881

Analysis Generated

Apr 13, 2026 - 07:15 vuln.today

CVE Published

Apr 13, 2026 - 06:00 nvd

HIGH 8.6

DescriptionCVE.org

The Product Filter for WooCommerce by WBW WordPress plugin before 3.1.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks

AnalysisAI

SQL injection in Product Filter for WooCommerce by WBW plugin versions below 3.1.3 allows unauthenticated remote attackers to extract sensitive database contents including user credentials, customer data, and order information. The vulnerability requires no authentication (CVSS PR:N) and has low attack complexity with publicly available exploit code. EPSS data not available, but the combination of unauthenticated access, public POC, and WordPress's large attack surface creates substantial real-world risk for unpatched WooCommerce installations.

Technical ContextAI

This is a classic SQL injection vulnerability (CWE-89) in a WordPress plugin that extends WooCommerce filtering functionality. The flaw stems from improper input sanitization of a user-controllable parameter that is concatenated directly into a SQL query string without parameterization or adequate escaping. The affected component is the Product Filter for WooCommerce by WBW plugin (cpe:2.3:a:unknown:product_filter_for_woocommerce_by_wbw). SQL injection occurs when untrusted data is inserted into database queries, allowing attackers to manipulate query logic, bypass authentication, extract data, or modify database contents. The unauthenticated nature (PR:N in CVSS vector) indicates the vulnerable parameter is accessible without any WordPress login, likely through a publicly exposed AJAX endpoint or front-end filter interface commonly used in WooCommerce product catalog pages.

RemediationAI

Immediately upgrade the Product Filter for WooCommerce by WBW plugin to version 3.1.3 or later through the WordPress admin dashboard (Plugins > Installed Plugins > Update) or via manual download from the WordPress plugin repository. Version 3.1.3 contains the necessary input sanitization and SQL query parameterization fixes to prevent injection attacks. For sites that cannot immediately patch, temporary mitigation includes disabling the plugin entirely until upgrade is possible, though this will break product filtering functionality. Do not attempt to implement custom input filtering as a workaround-proper parameterized queries in the upstream code are required. After patching, review database access logs for suspicious queries containing UNION, SELECT, or encoded SQL commands in product filter parameters to identify potential prior exploitation. Consult the WPScan advisory at https://wpscan.com/vulnerability/768014fd-0403-4182-b19e-3d46c92d8755/ for additional technical details and indicators of compromise.