The Product Filter plugin for WooCommerce by WBW is vulnerable to a time‑based SQL injection through its filtersDataBackend parameter. The flaw stems from inadequate escaping of user‑supplied data and the absence of prepared statements within the core query construction. As a result, unauthenticated users can append arbitrary SQL statements, enabling them to read confidential data from the database. This weakness corresponds to CWE‑89, classification of SQL injection.

The vulnerability affects all versions of the plugin up to and including 2.7.9. The affected product is the WooCommerce product‑filter plugin developed by woobewoo, a popular WordPress shortcode plugin that allows advanced filtering of product listings. The flaw is present in the core PHP files located in the meta models directory, as noted in the provided references.

The CVSS score of 7.5 indicates a high impact vulnerability, while the EPSS score of less than 1% reflects a low likelihood of exploitation at present. The flaw is not listed in the CISA KEV catalog, and no official exploit has been publicly disclosed. Attackers would need only to send a crafted HTTP request to an exposed endpoint containing the filtersDataBackend parameter, which is accessible without authentication, to execute the attack. Consequently, the risk remains significant if the plugin is left on a publicly reachable WordPress site.