{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/wbw/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wbw:product_filter_by_wbw:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.3,"id":"CVE-2026-112866"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Product Filter by WBW (\u003c= 3.4.6)"],"_cs_severities":["high"],"_cs_tags":["wordpress","sql-injection","web-application"],"_cs_type":"advisory","_cs_vendors":["WBW"],"content_html":"\u003cp\u003eCVE-2026-112866 is a blind SQL injection vulnerability in the Product Filter by WBW plugin for WordPress. The vulnerability affects versions up to and including 3.4.6. The issue stems from improper neutralization of special elements used in SQL commands. Proof-of-concept exploit code is publicly available, increasing the risk of active exploitation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to perform blind SQL injection, which can lead to the unauthorized extraction of sensitive data from the WordPress database.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the 'Product Filter by WBW' plugin to the latest version, ensuring it is beyond 3.4.6.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous SQL syntax or large numbers of 200/500 responses directed at plugin-specific URI parameters.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, disable the 'Product Filter by WBW' plugin until a secure update is applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-24T11:13:02Z","date_published":"2026-10-24T11:13:02Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-112866/","summary":"An unauthenticated blind SQL injection vulnerability (CVE-2026-112866) exists in the Product Filter by WBW WordPress plugin, allowing attackers to access database information via the plugin frontend.","title":"Product Filter by WBW: Blind SQL Injection (CVE-2026-112866)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-112866/"}],"language":"en","title":"CraftedSignal Threat Feed - WBW","version":"https://jsonfeed.org/version/1.1"}