CVE-2026-95601: Product Filter by WBW SQLi Vulnerability

CVE-2026-95601 Overview

CVE-2026-95601 is an unauthenticated SQL injection vulnerability in the Product Filter by WBW WordPress plugin, affecting versions up to and including 3.1.7. The flaw allows remote attackers to inject arbitrary SQL statements into database queries without authentication or user interaction. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Because the plugin is deployed on WooCommerce-based storefronts, exploitation can expose customer records, order data, and administrative credentials stored in the WordPress database.

Critical Impact
Unauthenticated network-based SQL injection with scope change, enabling attackers to read sensitive database contents and disrupt availability of affected WordPress storefronts.

Affected Products

Product Filter by WBW plugin for WordPress (also distributed as woo-product-filter)
All versions up to and including 3.1.7
WooCommerce sites deploying the plugin for product filtering

Discovery Timeline

2026-09-23 - CVE-2026-95601 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95601

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input within SQL statements executed by the Product Filter by WBW plugin. An unauthenticated attacker can submit crafted parameters over the network that are concatenated directly into database queries. Because no privileges or user interaction are required, exploitation can be automated at scale against exposed WordPress installations.

The scope change indicated in the CVSS vector reflects that a successful attack can impact resources beyond the vulnerable plugin, including the underlying WordPress database and any co-tenant data stored there. Confidentiality impact is high because the database typically contains hashed administrator credentials, session tokens, customer personally identifiable information (PII), and order details.

Root Cause

The root cause is failure to parameterize SQL queries built from HTTP request parameters. Instead of using prepared statements via $wpdb->prepare(), the plugin appears to concatenate untrusted input into query strings, producing a classic first-order SQL injection pattern.

Attack Vector

Exploitation occurs over the network against the plugin's front-facing endpoints. An attacker sends HTTP requests with malicious payloads in filter-related parameters. The database interprets injected SQL clauses such as UNION SELECT or boolean-based conditions, returning attacker-controlled results or exposing data through timing side channels.

For technical specifics, refer to the Patchstack Vulnerability Review. No public proof-of-concept exploit has been published at the time of this writing.

Detection Methods for CVE-2026-95601

Indicators of Compromise

HTTP requests to WordPress endpoints containing SQL metacharacters such as UNION, SLEEP(, --, /*, or 0x in filter parameters associated with the woo-product-filter plugin.
Anomalous database queries originating from the WordPress process, including queries against wp_users or wp_usermeta that do not match normal application flow.
Sudden spikes in HTTP 500 responses or elevated response latency on plugin-handled URLs, consistent with time-based SQL injection probing.

Detection Strategies

Deploy web application firewall (WAF) signatures that flag SQL injection payload patterns targeting WordPress plugin parameters.
Enable MySQL/MariaDB general query logging temporarily to correlate suspicious application requests with database statements.
Monitor WordPress access logs for repeated requests from single source IPs against filter endpoints, particularly with encoded payloads.

Monitoring Recommendations

Baseline normal request patterns for the plugin and alert on deviations in parameter length, encoding, or character composition.
Alert on outbound data transfers from the web server that exceed typical response sizes, which may indicate database exfiltration.
Track administrator account creation, password resets, and role changes in wp_users and wp_usermeta for unauthorized modifications.

How to Mitigate CVE-2026-95601

Immediate Actions Required

Update the Product Filter by WBW plugin to a version later than 3.1.7 as soon as a fixed release is available from the vendor.
Deploy WAF rules blocking common SQL injection patterns targeting the woo-product-filter plugin endpoints until the patch is applied.
Audit the WordPress database for unauthorized administrator accounts, modified user roles, and unexpected data changes.
Rotate all WordPress administrator credentials, API keys, and secrets stored in wp_options if compromise is suspected.

Patch Information

Consult the Patchstack Vulnerability Review for the latest patch status and fixed version guidance from the plugin vendor.

Workarounds

Temporarily disable and deactivate the Product Filter by WBW plugin until a patched version is installed.
Restrict access to WordPress administrative and plugin endpoints using IP allowlisting where feasible.
Apply virtual patching through a WAF to reject requests containing SQL metacharacters in plugin filter parameters.

bash

# Example WAF rule concept for blocking SQL injection payloads (ModSecurity syntax)
SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|benchmark\s*\(|--\s|/\*!)" \
    "id:1009561,phase:2,deny,status:403,\
    msg:'Potential SQLi targeting woo-product-filter (CVE-2026-95601)',\
    tag:'CWE-89'"