CVE-2026-112866criticalCWE-89

CVE-2026-112866: critical vulnerability in WPFactory Product Filter by WBW

WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability

Published

Follow this CVE+ Monitor Product Filter by WBW

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.3epss 1.2%
from disclosure to weapon1 day
Published on NVDOct 24
1st PoC+1d
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Affected products
WPFactory · Product Filter by WBW
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.