Description

Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-24T22:16:51.510Z",
  "pubdate": "2026-08-24T22:16:51.510Z",
  "executiveSummary": "An unauthenticated SQL injection vulnerability has been identified in the WooBeWoo Product Filter Pro plugin for WordPress, specifically affecting versions 3.1.8 and prior. This security flaw allows remote, unauthenticated threat actors to manipulate database queries by injecting arbitrary SQL commands through vulnerable application parameters.\nThe primary impact of this vulnerability includes unauthorized database access, potential extraction of sensitive application data such as user credentials and configuration details, and the possibility of comprehensive database compromise depending on the database user privileges associated with the underlying web application.\nThe affected product is the WooBeWoo Product Filter Pro plugin within WordPress deployments. The risk implications are severe, as the absence of authentication requirements significantly lowers the barrier to entry for malicious actors, enabling automated exploitation across the internet.\nExploitation requirements are minimal, necessitating only network access to a vulnerable WordPress instance running an unsupported version of the plugin. No prior user interaction, privileges, or session tokens are required to successfully execute the attack.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input sanitization and lack of parameterized queries within the WooBeWoo Product Filter Pro plugin <= 3.1.8. User-supplied input parameters handled by the plugin are directly concatenated into SQL statement strings without adequate validation or escaping, allowing external data to influence the logical structure of database queries executed against the backend database management system.\nThe vulnerability is exposed over the network via HTTP requests targeting the endpoints managed by the vulnerable plugin component. Because the affected functionality does not enforce authentication or session validation, any remote unauthenticated user can interact with the vulnerable code path.\nThe exploitation method involves crafting specialized HTTP requests containing malicious SQL payloads appended to vulnerable input parameters processed by the product filtering logic. When the application receives the request, the insecure component processes the input and incorporates the malicious payload directly into the active database query execution context.\nThe step-by-step attack flow proceeds as follows: First, the attacker identifies a target WordPress site utilizing an affected version of the WooBeWoo Product Filter Pro plugin and locates the request parameters associated with the product filtering mechanism. Second, the attacker crafts a payload utilizing SQL syntax manipulation techniques, such as UNION-based injection or boolean-based blind injection, to extract information or alter database states. Third, the attacker transmits the crafted HTTP request to the target server. Fourth, the vulnerable component parses the input and executes the resulting malformed SQL query against the database. Finally, the database returns the query results or exhibits error behaviors that the attacker interprets to extract sensitive data or confirm exploitation.\nThe post-exploitation impact is extensive. An attacker leveraging this SQL injection vulnerability can read arbitrary tables within the database, potentially exposing administrator password hashes, customer records, and proprietary site data. In environments with misconfigured database permissions or stacked query support, attackers may achieve remote code execution, escalate privileges within the application ecosystem, or cause a complete denial of service by corrupting or deleting critical database tables."
}