CVE-2026-3830

The Product Filter for WooCommerce by WBW plugin for WordPress fails to sanitize and escape a parameter before using it in a SQL statement. This lack of input validation allows unauthenticated users to inject malicious SQL queries.

An attacker without any authentication can exploit this vulnerability by sending a specially crafted request to the vulnerable parameter. No special privileges or network access is required, making the attack surface broad and easily exploitable.

Successful exploitation of this SQL injection can lead to unauthorized reading, modification, or deletion of sensitive database content, including user credentials, posts, and configuration data. This could result in full compromise of the WordPress site.

The vulnerability has been addressed in version 3.1.3 of the plugin. Users are strongly advised to update to the latest version immediately to mitigate the risk [1].