CVE-2026-112866 WPFactory CVE debrief

Who should care

Defenders and security teams responsible for WordPress installations using the Product Filter by WBW plugin should assess exposure and prioritize remediation. This includes administrators, security analysts, and incident response teams.

Why it matters

CVE-2026-112866 is a critical SQL injection vulnerability in the Product Filter by WBW WordPress plugin. Defenders should assess exposure, prioritize remediation, and implement monitoring to detect potential exploitation attempts. The vulnerability allows for blind SQL injection, posing a significant risk to affected systems, with a CVSS score of 9.3. Immediate action is required to prevent potential data breaches and service disruptions.

• Potential for unauthorized database queries, allowing attackers to access or manipulate sensitive data.
• Risk of data breaches due to exploitation of the SQL injection vulnerability.
• Possible disruption of service through exploitation attempts, impacting system availability.
• Need for verification of system exposure and plugin version assessment.

Technical summary

The Product Filter by WBW WordPress plugin, versions from n/a through 3.4.6, is vulnerable to SQL injection. This issue, identified as CVE-2026-112866, allows for blind SQL injection attacks. The vulnerability's CVSS score is 9.3, indicating critical severity. The Common Weakness Enumeration (CWE) associated with this vulnerability is CWE-89, Improper Neutralization of Special Elements used in an SQL Command.

Defensive priority

Immediate assessment and remediation are required for systems utilizing the vulnerable plugin version.

Recommended defensive actions

• Assess exposure by identifying systems using the vulnerable Product Filter by WBW plugin version.
• Prioritize remediation for affected systems, focusing on upgrading to a non-vulnerable version.
• Implement monitoring to detect potential exploitation attempts.
• Review and update inventory records for accurate tracking of vulnerable assets.

Evidence notes

The vulnerability is confirmed through CVE and NVD records, with additional details from Patchstack. However, specific exploitation details or victim information are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.