The vulnerability in WordPress Product Filter by WBW (WPFactory) results from improper neutralization of special elements inside SQL commands, allowing blind SQL injection. According to the CVE description, this flaw permits an attacker to send crafted queries that are executed by the database without producing visible output, potentially enabling the attacker to infer or manipulate database content.

Any WordPress site that has the Product Filter by WBW plugin installed with a version up to and including 3.4.6 is affected. The plugin is known as WPFactory Product Filter by WBW, and the advisory recommends upgrading to version 3.4.7 or later to eliminate the injection vector.

The CVSS score of 9.3 classifies the vulnerability as critical, and the EPSS score is not available. It is not listed in the CISA KEV catalog. Based on typical WordPress plugin behavior, the likely attack vector is a remote attacker submitting specially crafted HTTP requests to the site. Because the flaw is described as a blind SQL injection, the exploitation requirement is the presence of the vulnerable plugin and an ability to send arbitrary input to the plugin’s processing code.