WBW - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/wbw/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 24 Oct 2026 11:13:02 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgProduct Filter by WBW: Blind SQL Injection (CVE-2026-112866)https://feed.craftedsignal.io/briefs/2026-10-cve-2026-112866/Sat, 24 Oct 2026 11:13:02 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cve-2026-112866/An unauthenticated blind SQL injection vulnerability (CVE-2026-112866) exists in the Product Filter by WBW WordPress plugin, allowing attackers to access database information via the plugin frontend.CVE-2026-112866 is a blind SQL injection vulnerability in the Product Filter by WBW plugin for WordPress. The vulnerability affects versions up to and including 3.4.6. The issue stems from improper neutralization of special elements used in SQL commands. Proof-of-concept exploit code is publicly available, increasing the risk of active exploitation.

Impact

Successful exploitation allows unauthenticated attackers to perform blind SQL injection, which can lead to the unauthorized extraction of sensitive data from the WordPress database.

Recommendation

  • Immediately update the 'Product Filter by WBW' plugin to the latest version, ensuring it is beyond 3.4.6.
  • Review web server access logs for anomalous SQL syntax or large numbers of 200/500 responses directed at plugin-specific URI parameters.
  • If immediate patching is not possible, disable the 'Product Filter by WBW' plugin until a secure update is applied.
]]>highadvisorywordpresssql-injectionweb-application