Feedly Critical SQL Injection Vulnerability in WPFactory Product Filter Disclosed
Article Content
- •CVE-2026-112866 allows blind SQL injection in WPFactory Product Filter versions up to 3.4.6.
- •The vulnerability has a CVSS score of 9.3, classified as critical.
- •A patch is available, and users are urged to upgrade to avoid potential data breaches.
A critical SQL Injection vulnerability (CVE-2026-112866) has been identified in the WPFactory Product Filter by WBW, affecting versions up to 3.4.6. This flaw allows unauthenticated attackers to perform blind SQL injection attacks, potentially leading to data exfiltration and service disruption. Currently, there is no evidence of or public proof-of-concept code. A patch has been released via GitHub Advisory GHSA-3pqj-4593-j73m, and users are advised to upgrade to versions beyond 3.4.6. The CVSS score for this vulnerability is 9.3, indicating a critical severity level. Security measures such as input validation and the implementation of Web Application Firewall (WAF) rules are recommended to mitigate risks.
Ask AI about this cluster
Answers cite the sources they use
More articles in this cluster (3)
Following this threat?
Track CVE-2026-112866 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which versions of WPFactory Product Filter are affected?
Is there any evidence of exploitation?
What should I do to protect my system?
Continue Reading
Critical CVE-2026-115889: Wasmtime Vulnerability Allows Sandbox Escape CVE-2026-115889 is a critical vulnerability in Wasmtime's Cranelift compiler backend, allowing attackers to exploit silent overflow in SSA value indices, leading to potential arbitrary code execution and sandbox escape. This affects Wasmtime versions prior to 36.0.19 and 43.0.0. Attackers with the ability to load…