Zero Radar
← feed
CriticalVulnerabilityCVE-2026-112866updated 25 Oct 2026, 17:20 UTC

WooCommerce product filter plugin lets attackers run hidden database queries

A WordPress plugin for filtering shop products has a flaw that lets outsiders sneak commands into the site's database. Attackers can slowly read or change stored data, such as customer or order information, without a visible error.

Official, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1AttackerSends crafted input to the shop
  2. 2Filter requestPlugin receives the unsafe input
  3. 3SQL queryInput is run inside a database command
  4. 4Hidden dataAnswers leak one bit at a time
  5. ResultAttacker reads or alters store data

What happened

Blind SQL injection in WPFactory's Product Filter by WBW (woo-product-filter) WordPress plugin, where user input is not properly neutralized before being used in SQL commands.

Why it is dangerous: An attacker could read or modify database contents, potentially exposing customer and store data. Online shops running this plugin are at risk.

Are you affected?

You are affected if you run the Product Filter by WBW (woo-product-filter) plugin version 3.4.6 or earlier on your WordPress site.

Product Filter by WBW (woo-product-filter) by WPFactory, all versions through 3.4.6

What to do

  1. Check whether the Product Filter by WBW plugin is installed and what version it is
  2. Update the plugin to a version newer than 3.4.6 as soon as a fixed release is available
  3. If no fix is available yet, deactivate the plugin or restrict access to its features until one is released
  4. Review database and access logs for unusual query patterns

Timeline

  1. 24 Oct 2026, 08:16 UTC
    Publicly disclosed
  2. 24 Oct 2026, 08:16 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 17:20 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-112866 · GHSA-3pqj-4593-j73m
CVSS
9.3 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
24 Oct 2026, 08:16 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 17:20 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

WooCommerce product filter plugin lets attackers run hidden database queries · Zero Radar