EUVD-2026-85504
GHSA-99f5-94c9-vwcj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running vulnerable WBW filter plugin
-
DeliverySend crafted product-filter request with SQL payload
-
ExploitInjected query executes against database
-
ExecutionExtract user credentials and sensitive data
-
ImpactEscalate toward account/admin takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond having the affected plugin installed - remote unauthenticated exploitation is possible against default configurations of any WordPress/WooCommerce site running Product Filter by WBW version 3.1.7 or earlier. The plugin's public-facing product-filter functionality is reachable without login (PR:N) and requires no victim interaction (UI:N). The primary limiting factor is simply whether the site has this specific plugin active and exposed; there is no dependence on a non-default setting, elevated privilege, or specific platform beyond a standard WordPress deployment. |
| Impact | This is a genuinely high-priority issue on paper: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated SQL injection, which is among the most reliably exploited web vulnerability classes and typically requires no user interaction. The vendor score of 9.3 is driven largely by the S:C scope change; I consider S:C questionable for a classic in-application SQLi (the injected query executes within the same database security authority), and I would rate it S:U for a more defensible ~7.5. Impact is confidentiality-focused (C:H - full database read of WordPress/WooCommerce data including user records and password hashes), with the vendor asserting a minor availability impact (A:L) and no integrity impact (I:N). No EPSS score, CISA KEV listing, POC availability, or SSVC decision data is provided in the input, so exploitation-probability and automatability signals cannot be corroborated - the priority rests on the vulnerability class and unauthenticated reachability, not on confirmed exploitation. Because unauthenticated SQLi in WordPress plugins is historically a favored target for automated mass-scanning once a POC surfaces, this should be treated as a real patch-now item on affected sites despite the absence of current exploitation evidence. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a WooCommerce store running Product Filter by WBW <= 3.1.7, injecting SQL through an unsanitized filter parameter to read arbitrary database contents such as user credentials and session data. No authentication or user interaction is required (PR:N/UI:N), making the attack scriptable at scale against exposed storefronts. No public POC is identified in the provided data, though Patchstack has documented the flaw. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Unauthenticated SQL injection in the WordPress/WooCommerce plugin Product Filter by WBW (versions 3.1.7 and earlier) lets any remote visitor inject SQL through the plugin's public-facing product-filter functionality and read arbitrary data from the site's database, with no login and no victim interaction required. The reporting source (Patchstack) and ENISA EUVD both classify this as a high-severity SQLi, while the assessed vector constrains the impact to confidentiality only (C:H/I:N/A:N) rather than the scope-change-plus-availability model that produces the 9.3 headline score, so the practical effect is large-scale data disclosure rather than remote code execution or denial of service. No public exploit code has been identified and there is no evidence of active exploitation at time of analysis; exploitation depends solely on whether the affected plugin is installed, active, and reachable on a standard WordPress deployment.
RemediationAI
No vendor-released patched version is identified in the available advisory data, so the immediate priority is to check the plugin's WordPress.org repository page and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/woo-product-filter/vulnerability/wordpress-product-filter-by-wbw-plugin-3-1-7-sql-injection-vulnerability?_s_id=cve) for a release above 3.1.7 and upgrade to it as soon as it appears; do not assume a fix exists simply because the advisory is published. Where an update is not yet available, deactivate and remove Product Filter by WBW from all internet-facing WooCommerce sites - this removes the vulnerable front-end filter endpoints entirely and is the only fully reliable mitigation, at the cost of losing the product-filtering feature. If the plugin must stay enabled for business reasons, the practical compensating controls are: block or challenge unauthenticated requests to the plugin's filtering endpoints (its admin-ajax.php actions and any filter query parameters) at the WAF or reverse proxy, noting that over-broad rules can break legitimate shopper filtering; apply a virtual patch that rejects SQL metacharacters and union/boolean/error-based payload patterns in those parameters; and temporarily restrict access to the affected pages to authenticated or allow-listed users, which degrades the storefront experience for anonymous shoppers. Because injected queries would expose credential hashes, coupons, and customer records, also review database and WAF logs for anomalous filter requests, and rotate WordPress salts/sessions and any credentials that may have been exposed if compromise is suspected.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a CWE-89 improper-neutralization SQL injection in a third-party WooCommerce extension, Product Filter by WBW, whose public filter widgets accept visitor-supplied parameters (attribute, category, price, and similar filter values) and pass them into database queries without proper parameterization or escaping. Because the vulnerable code path is the front-end filtering surface - typically reached via unauthenticated AJAX actions such as admin-ajax.php with a nopriv handler, or via front-end query variables generated by the plugin's shortcodes - the flaw is network-reachable, low-complexity, and requires no privileges (PR:N) and no user interaction (UI:N). The CPE string cpe:2.3:a:wbw_plugins:product_filter_by_wbw:*:*:*:*:*:*:*:* declares a wildcard version range for the wbw_plugins vendor, and EUVD lists "Product Filter by WBW ≤3.1.7", confirming that all releases up to and including 3.1.7 fall in scope and that no fixed version has been enumerated in the available intelligence. Successful injection would allow extraction of data from WordPress core and WooCommerce tables - including user credential hashes, session and password-reset tokens, and customer/order records - via union-, error-, or boolean-based techniques, which is consistent with the assessed confidentiality-high impact and the absence of assessed integrity or availability impact.
Know when Product Filter By Wbw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SQLi gives AV:N/AC:L/PR:N/UI:N and C:H for full DB read; I use S:U (in-DB authority, no cross-authority impact) and drop A:L as unsubstantiated.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.
Articles & Coverage 1
Executive ViewAI
The Product Filter by WBW plugin (3.1.7 and earlier) for WordPress/WooCommerce can expose a site's database to unauthorized read access through its public-facing filter, potentially disclosing customer, order, and other sensitive records. No public exploit identified at time of analysis, but because no vendor patch is available and the plugin is reachable by remote visitors, affected organizations should act to reduce regulatory, reputational, and customer-trust risk.
No vendor-released patch identified at time of analysis; disable or remove Product Filter by WBW 3.1.7 and earlier, block public access to the plugin's filter endpoints, deploy WAF/IPS virtual patching for SQL injection, restrict database account permissions, and monitor for anomalous queries or data exfiltration.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB