CVE-2026-39494: WordPress Product Filter by WBW plugin <= 3.1.2 - SQL Injection vulnerability

Synopsis

An unauthenticated SQL injection vulnerability affects the Product Filter by WBW WordPress plugin at version 3.1.2 and below. The flaw is reachable over the network without any login or account, and the attack requires no interaction from a site visitor. Successful exploitation allows an attacker to perform blind SQL injection, reading sensitive data from the underlying database, and can cause limited service disruption. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress site via HTTP or HTTPS to deliver the malicious payload.

• AuthenticationNot required

  No account or session token of any kind is needed; the vulnerable parameter is accessible to anonymous HTTP requests.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any site visitor or administrator.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout knowledge, or environmental prerequisites are needed.

Blast Radius

• An attacker can extract data from the WordPress database through blind SQL injection, including user credentials (hashed passwords), email addresses, session tokens, and any stored customer or order records.
• Database integrity is not directly at risk from this vulnerability (Integrity impact is rated None in the CVSS vector), but exfiltrated credentials could enable follow-on account takeover.
• The Availability impact is rated Low, meaning the attacker can cause intermittent query failures or elevated database load, producing partial service disruption for site visitors.
• Because the CVSS Scope token is Changed, the impact can extend beyond the plugin itself to other components sharing the same database, such as other installed WordPress plugins or the WordPress core tables.