CVE-2026-112866

Summary

Blind SQL injection in the WPFactory Product Filter plugin (versions through 3.4.6) allows attackers to infer database contents by observing timing or response differences, due to unsanitized user input passed to SQL queries.

Exploitability

Exploitation is straightforward for remote attackers with network access and no authentication required, relying on time-based or error-based blind techniques.

Blast radius

Successful exploitation could lead to full compromise of backend data confidentiality and limited availability via resource exhaustion, though integrity impact is minimal per CVSS.

Detection

Defenders may observe unusually long HTTP response times (e.g., >5 seconds) in requests to the plugin's filtering endpoints, especially when crafted payloads containing SQL time-delay functions (e.g., SLEEP(), BENCHMARK()) are submitted; however, no reliable log or network indicator is guaranteed due to the blind nature of the injection.

Prioritized remediation

Upgrade to Product Filter by WBW version 3.4.7 or later, which contains the vendor's fix for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.