The WBW Plugins Product Filter by WBW plugin has a blind SQL injection flaw, identified as CWE‑89, due to improper neutralization of special elements in SQL commands. This vulnerability allows an attacker to inject arbitrary SQL statements, potentially enabling unauthorized read, modification, or deletion of database data, which could compromise site confidentiality, integrity, and possibly elevate privileges.

All releases of the WP Product Filter by WBW plugin from the initial version through 3.1.2 are affected. WordPress installations using any of these versions are vulnerable until an update to at least 3.1.3 is applied.

The CVSS score of 9.3 signals a high severity flaw, while EPSS data is not available and the issue is not listed in the CISA KEV catalog, indicating no confirmed public exploitation to date. The likely attack vector is via publicly accessible product-filter inputs, where crafted requests can trigger the blind SQL injection without user authentication. Successful exploitation could grant full SQL execution rights against the database, exposing sensitive data and facilitating further attacks.