CVE-2026-32554: WooBeWoo Product Filter Pro SQLi Flaw

CVE-2026-32554 Overview

CVE-2026-32554 is an unauthenticated SQL injection vulnerability in the WooBeWoo Product Filter Pro plugin for WordPress. The flaw affects all versions up to and including 3.1.8. Attackers can inject arbitrary SQL statements without authentication, exploiting improper neutralization of special elements used in an SQL command [CWE-89]. The vulnerability was published to the National Vulnerability Database (NVD) on August 24, 2026 and is tracked by Patchstack.

Critical Impact
Unauthenticated attackers can execute arbitrary SQL queries against the WordPress database, exposing sensitive data including user credentials, session tokens, and customer records from WooCommerce stores.

Affected Products

WooBeWoo Product Filter Pro plugin for WordPress
Versions <= 3.1.8
WooCommerce sites using the WooFilter Pro plugin

Discovery Timeline

2026-08-24 - CVE-2026-32554 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-32554

Vulnerability Analysis

The vulnerability resides in the WooBeWoo Product Filter Pro plugin, a WooCommerce product filtering extension for WordPress. User-supplied input reaches SQL query construction without proper sanitization or parameterization. Because the affected code path does not require authentication, any remote attacker with network access to the WordPress site can trigger the flaw.

Successful exploitation allows execution of attacker-controlled SQL statements in the context of the WordPress database user. This typically grants read access to the entire wp_ schema, including wp_users password hashes and wp_usermeta session tokens. In WooCommerce deployments, customer order data and personally identifiable information (PII) are also at risk.

The issue is classified under Improper Neutralization of Special Elements used in an SQL Command [CWE-89].

Root Cause

The root cause is unsanitized user input being concatenated directly into SQL query strings within a plugin endpoint reachable without authentication. WordPress plugins should use $wpdb->prepare() with placeholder tokens to bind parameters, but the affected code path bypasses this safeguard.

Attack Vector

Exploitation occurs remotely over the network by sending a crafted HTTP request to a plugin endpoint that processes filter parameters. No user interaction and no authentication are required. The scope is changed, meaning a successful attack can affect resources beyond the vulnerable component, such as other databases or connected services sharing the same credentials.

Refer to the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-32554

Indicators of Compromise

HTTP requests containing SQL syntax such as UNION SELECT, SLEEP(, information_schema, or -- in parameters targeting Product Filter Pro endpoints.
Unusual outbound database query patterns or unexpected SELECT operations against wp_users and wp_options tables.
WordPress access logs showing repeated requests to admin-ajax.php or plugin AJAX endpoints with encoded payloads.
New administrator accounts or modified wp_options entries following suspicious plugin requests.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule set that inspects request parameters for SQL injection signatures targeting the WooFilter Pro plugin path.
Enable MySQL general query logging temporarily to identify anomalous query structures originating from the WordPress web user.
Correlate WordPress debug.log errors with web server access logs to detect malformed queries caused by injection attempts.

Monitoring Recommendations

Alert on HTTP 500 responses from plugin endpoints, which often indicate failed injection attempts.
Monitor for spikes in database CPU or query latency, indicators of time-based blind SQL injection.
Track file integrity for WordPress core files and the wp-content/plugins/woofilter-pro/ directory.

How to Mitigate CVE-2026-32554

Immediate Actions Required

Update WooBeWoo Product Filter Pro to a version later than 3.1.8 as soon as a patched release is available from the vendor.
If a patched version is not yet available, deactivate and remove the plugin from all WordPress installations.
Rotate all WordPress administrator passwords and force session invalidation for existing users.
Review the WordPress database for unauthorized accounts, modified options, and injected content.

Patch Information

A fixed release addressing CVE-2026-32554 should be applied once published by WooBeWoo. Consult the Patchstack Vulnerability Report for the current fixed version. Patchstack subscribers may receive virtual patching before the official plugin update is released.

Workarounds

Block requests to the vulnerable plugin endpoints at the WAF or reverse proxy layer until patching is complete.
Restrict access to /wp-admin/admin-ajax.php with rate limiting and IP allowlists where feasible.
Apply the principle of least privilege to the WordPress database user, revoking unnecessary FILE, CREATE, and DROP privileges.

bash

# Example WAF rule (ModSecurity) to block SQLi patterns on WooFilter Pro endpoints
SecRule REQUEST_URI "@contains /wp-content/plugins/woofilter-pro/" \
  "id:1032554,phase:2,deny,status:403,\
  chain,msg:'CVE-2026-32554 SQLi attempt'"
  SecRule ARGS "@rx (?i)(union[[:space:]]+select|sleep\(|information_schema|--\s|;\s*drop)" \
    "t:none,t:urlDecodeUni"