CVE-2026-112866

{
  "etk_id": "ETK-2026-2546",
  "cve_id": "CVE-2026-112866",
  "display_id": "CVE-2026-112866",
  "ghsa_id": "GHSA-3pqj-4593-j73m",
  "euvd_id": "EUVD-2026-109250",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Blind SQL injection in Product Filter by WBW",
  "summary": "Product Filter by WBW versions through 3.4.6 are affected by a blind SQL-injection vulnerability. A remote attacker may issue crafted requests that influence database queries without needing to authenticate or persuade a user to act.",
  "mitigation": "Update to a vendor release later than 3.4.6 when one is available. Until then, reduce exposure by restricting public access to the affected WordPress functionality and applying request filtering at the network edge.",
  "vendor": "WPFactory",
  "product": "Product Filter by WBW",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 3.4.6"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "woo-product-filter",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.0155217,
  "t0_at": "2026-10-24T08:00:11.483000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-24T15:40:57.128590+00:00",
      "days": 0.3199727498842593,
      "is_lower_bound": false,
      "measured_at": "2026-10-24T08:00:11.483000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-24T08:00:11.483000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-24T08:00:11.483000+00:00",
      "url": "https://github.com/advisories/GHSA-3pqj-4593-j73m"
    }
  }
}