Product Filter by WBW: Blind SQL Injection (CVE-2026-112866)
An unauthenticated blind SQL injection vulnerability (CVE-2026-112866) exists in the Product Filter by WBW WordPress plugin, allowing attackers to access database information via the plugin frontend.
CVE search metadata
CVE search record: CVE-2026-112866. Severity: critical. CVSS: 9.3. KEV: no. Product: Product Filter by WBW (<= 3.4.6). Brief: Product Filter by WBW: Blind SQL Injection (CVE-2026-112866). Brief link: https://feed.craftedsignal.io/briefs/2026-10-cve-2026-112866/
Triage facts
Revision 1- Applicability
- Product Filter by WBW (<= 3.4.6)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 3 public sources
- Freshness
- Revision 1Oct 24, 11:13 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
CVE-2026-112866 is a blind SQL injection vulnerability in the Product Filter by WBW plugin for WordPress. The vulnerability affects versions up to and including 3.4.6. The issue stems from improper neutralization of special elements used in SQL commands. Proof-of-concept exploit code is publicly available, increasing the risk of active exploitation.
Impact
Successful exploitation allows unauthenticated attackers to perform blind SQL injection, which can lead to the unauthorized extraction of sensitive data from the WordPress database.
Recommendation
- Immediately update the 'Product Filter by WBW' plugin to the latest version, ensuring it is beyond 3.4.6.
- Review web server access logs for anomalous SQL syntax or large numbers of 200/500 responses directed at plugin-specific URI parameters.
- If immediate patching is not possible, disable the 'Product Filter by WBW' plugin until a secure update is applied.
Immediate actions
Patch Product Filter by WBW to a version greater than 3.4.6
Threat Hunt
Monitor web server access logs for patterns associated with SQL injection attempts targeting WordPress plugin endpoints
Data: Web server logs (access.log)
Mitigations
Disable Product Filter by WBW plugin
CVE-2026-112866