Back Sploitus

CVE-2026

Sploitus • October 24, 2026

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SQL Injection Vulnerability in WPFactory Product Filter Disclosed A critical SQL Injection vulnerability (CVE-2026-112866) has been identified in the WPFactory Product Filter by WBW, affecting versions up to 3.4.6. This flaw allows unauthenticated attackers to perform blind SQL injection attacks, potentially leading to data exfiltration and service disruption. Currently, there is no evidence of or public proof-of-concept code. A patch has been released via GitHub Advisory GHSA-3pqj-4593-j73m, and users are advised to upgrade to versions beyond 3.4.6. The CVSS score for this vulnerability is 9.3, indicating a critical severity level. Security measures such as input validation and the implementation of Web Application Firewall (WAF) rules are recommended to mitigate risks. 2 sources 78

Extracted Entities

CVE-2026

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)