A flaw in the Product Filter for WooCommerce WordPress plugin before version 3.1.3 allows an unauthenticated user to submit a crafted request that bypasses input sanitization and injects arbitrary SQL code. This unauthorized injection can read, alter or delete any database table accessed by the plugin, thereby compromising data confidentiality and integrity. The weakness is a classic input validation flaw identified by CWE-89.

Any WordPress site that has installed Product Filter for WooCommerce by WBW and is running a version older than 3.1.3 is vulnerable. No other product versions or vendors are listed, and the vendor publisher is not identified.

The CVSS score of 8.6 indicates high severity, while the exceptionally low EPSS score (<1%) suggests that exploitation attempts are unlikely at present. Nevertheless the vulnerability is not cataloged by CISA’s KEV list, implying it is not yet widely exploited. Attackers can craft an HTTP request to the plugin’s parameter without needing credentials, thereby enabling remote SQL injection. Successful exploitation would grant the attacker wide-reaching database access and could lead to data theft, modification, or denial of service.