WBW Product Filter EUVD-2026-109250

Requires that the Product Filter by WBW (woo-product-filter) plugin version n/a through 3.4.6 is installed and active, typically on a WooCommerce storefront; the CVSS vector (PR:N/UI:N) indicates no authentication and no user interaction against default installations. The specific injectable parameter or filter request is not described in the available sources, so the exact trigger is unverified. Limiting factors: exploitation depends on the plugin being present and reachable, and because the flaw is blind SQL injection, data extraction is inference-based (boolean/time-based) rather than direct, which slows but does not prevent exploitation; no non-default configuration is stated as required.

The input CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) describes a remote, low-complexity, unauthenticated vulnerability - the worst-case precondition profile - with C:H confidentiality impact and scope-changed (S:C), yielding the 9.3 score; the supplied vector's PR:N means exploitation requires no authentication. vuln.today assigns a Decision label of act_now, and the issue was reported by Patchstack, a credible WordPress-focused source. However, the signals are not uniformly corroborating: no EPSS exploitation-probability score is provided, the CVE is not listed in CISA KEV, and no confirmed proof-of-concept or exploit code is present (the sole reference is a Patchstack vulnerability-database entry, not a PoC). CWE-89 SQL injection in an internet-facing WordPress/WooCommerce plugin is a historically high-value, frequently-automated class, which supports the act_now urgency despite the absence of EPSS/KEV data. Net assessment: this is a genuine priority given the unauthenticated network vector and SQLi class, but confidence in real-world exploitation volume is limited because EPSS and KEV data are absent - treat the act_now label and SQLi class as the driving signals rather than confirmed mass exploitation.

A remote attacker sends crafted input to the vulnerable product-filter parameter on a public WooCommerce storefront running Product Filter by WBW (≤3.4.6), with no authentication required per the CVSS vector. Because the flaw is blind SQL injection, the attacker infers database contents (e.g., user credentials, order data, WordPress secrets) through boolean/time-based response differences. No public exploit identified at time of analysis, though the SQLi class is readily automatable.