CVE-2026-112866— WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability
Quick assessment
Affected
WPFactory Product Filter by WBW
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WPFactory 的"Product Filter by WBW"插件（woo-product-filter）存在 SQL 注入漏洞（即 SQL 命令中特殊元素未正确中和），可导致盲注 SQL 注入攻击。此问题影响该产品从未知版本至 3.4.6 版本。
Possible ATT&CK Techniques 1 AI
T1190.004
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-112866
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| WPFactory | Product Filter by WBW | 0 ~ 3.4.6 | - |
|
II. Public POCs for CVE-2026-112866
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-112866
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-112866 (1)
IV. Related Vulnerabilities
Same product: Product Filter by WBW
-
CVE-2026-95601
WordPress Product Filter by WBW plugin <= 3.1.7 - SQL Inject -
CVE-2026-39494
WordPress Product Filter by WBW plugin <= 3.1.2 - SQL Inject -
CVE-2023-50877
WordPress Product Filter by WBW plugin <= 2.5.0 - Broken Acc -
CVE-2024-49691
WordPress Product Filter by WBW plugin <= 2.7.0 - SQL Inject
Same vendor: WPFactory
-
CVE-2026-93771
WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PH -
CVE-2026-39437
WordPress Min Max Step Quantity Limits Manager for WooCommer -
CVE-2026-24993
WordPress Advanced WooCommerce Product Sales Reporting plugi -
CVE-2026-23977
WordPress Helpdesk Support Ticket System for WooCommerce plu -
CVE-2026-24992
WordPress Advanced WooCommerce Product Sales Reporting plugi
Same weakness: CWE-89
-
CVE-2026-111402
WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulne -
CVE-2026-46531
Cacti: Authenticated Stored 2nd-Order SQL Injection in autom -
CVE-2026-55465
Goobi viewer: Solr injection via unvalidated region paramete -
CVE-2026-114621
baserCMS: SQL injection in the admin panel and admin API -
CVE-2026-112837
WordPress GamiPress plugin <= 8.0.7 - SQL Injection vulnerab
V. Comments for CVE-2026-112866
No comments yet