CVE-2026-95601
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.
Risk Assessment
An unauthenticated attacker can manipulate SQL queries, potentially leading to data leakage, modification, or deletion in the database.
Recommendation
Update the Product Filter by WBW plugin to the latest version that includes the fix.
Other vulnerabilities in Product Filter by WBW
See all- CVE-2026-112866Critical
The WordPress plugin Product Filter by WBW (woo-product-filter) up to version 3.4.6 is vulnerable to blind SQL injection due to improper neutralization of special elements in SQL commands. An attacker could exploit this to manipulate database queries.
- CVE-2026-39494Critical
The SQL Injection vulnerability in the Product Filter by WBW allows for Blind SQL Injection attacks. This issue affects versions from n/a through 3.1.2.
- CVE-2025-11269Medium
The Product Filter by WBW plugin for WordPress (all versions up to and including 3.0.0) is vulnerable to unauthorized data modification due to a missing capability check on the 'approveNotice' action. An unauthenticated attacker can update the plugin's settings.
Original NVD description (English source)
Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS