Product Filter by WBW vulnerabilities

The WordPress plugin Product Filter by WBW (woo-product-filter) up to version 3.4.6 is vulnerable to blind SQL injection due to improper neutralization of special elements in SQL commands. An attacker could exploit this to manipulate database queries.

Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.

The SQL Injection vulnerability in the Product Filter by WBW allows for Blind SQL Injection attacks. This issue affects versions from n/a through 3.1.2.

The Product Filter by WBW plugin for WordPress (all versions up to and including 3.0.0) is vulnerable to unauthorized data modification due to a missing capability check on the 'approveNotice' action. An unauthenticated attacker can update the plugin's settings.