The Product Filter by WBW plugin for WordPress is vulnerable to SQL injection through the filtersDataBackend parameter in all versions up to 2.9.7. Because the input is not properly escaped or prepared, an attacker can append arbitrary SQL statements, allowing the extraction of sensitive data from the database. This vulnerability is a classic CWE-89 reflected injection and poses a significant confidentiality risk.

All WordPress installations that use the WooCommerce Product Filter by WBW add‑on, with versions 2.9.7 or earlier. The vendor is woobewoo and any site not upgraded beyond 2.9.7 remains affected.

The CVSS base score of 7.5 places the flaw in the high severity range, underscoring the potential impact if exploited. The EPSS score of < 1% indicates a very low probability that a publicly available exploit is being used today, and the flaw is not yet listed in CISA's KEV catalog. Nevertheless, because the attack vector is unauthenticated and can be triggered via a crafted HTTP request to the plugin's backend endpoint, an attacker with network visibility or control of the site’s front‑end can attempt injection. No elevated privileges or special conditions are required, further lowering the barrier to exploitation.