WPFactory Product Filter: SQL injection

WPFactory Product Filter by WBW

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.

Do this now

Check the vendor's advisory for a fix and restrict access to the Product Filter by WBW plugin until one is confirmed.

Still cooking for Product Filter by WBW.

First seen: 25 Oct 2026
Last update: 25 Oct 2026, 16:17 UTC
Identifiers: CVE-2026-112866
CVSS: 9.3
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## WPFactory Product Filter: SQL injection
Severity: critical. Patch status: fix status unknown.
Affected: WPFactory Product Filter by WBW
Ids: CVE-2026-112866

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.

## Steps
1. Search the repo, its CI and infra config for WPFactory Product Filter by WBW. If present, report the version in use and whether it's affected.
2. Product Filter by WBW <= 3.4.6: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Product Filter by WBW <= 3.4.6 | not named in the CVE record | check the vendor advisory: https://patchstack.com/database/wordpress/plugin/woo-product-filter/vulnerability/wordpress-product-filter-by-wbw-plugin-3-4-6-sql-injection-vulnerability?_s_id=cve | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-112866") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-112866 https://patchstack.com/database/wordpress/plugin/woo-product-filter/vulnerability/wordpress-product-filter-by-wbw-plugin-3-4-6-sql-injection-vulnerability?_s_id=cve
https://pwned.coffee/i/wpfactory-product-filter-sql-injection-cve-2026-112866

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Product Filter by WBW <= 3.4.6 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 25 Oct
The CVE record names no fix for one line; the vendor’s advisory may: patchstack.com
Score: CVSS 9.3 (critical). CVSS 3.1 9.3 (CNA Patchstack) for CVE-2026-112866
Last checked: 25 Oct 2026, 18:17 UTC

Product	Affected	Fixed in	Source
Product Filter by WBW	<= 3.4.6	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 25 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Totalone very hot coffee