PT-2025-43726 · WordPress · Product Filter By Wbw+1

Michael Mazzolini · Published 2025-10-25 · Updated 2025-10-30 · CVE-2025-8416

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Product Filter by WBW versions up to and including 2.9.7

Description The Product Filter by WBW plugin for WordPress is susceptible to SQL Injection via the filtersDataBackend parameter. Insufficient input validation and inadequate SQL query preparation allow attackers to inject additional SQL queries, potentially extracting sensitive information from the database.

Recommendations Update Product Filter by WBW to a version later than 2.9.7

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-8416

Affected Products

Product Filter By Wbw

Wordpress

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-8416 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d1533e9a-dcb9-4fbb-a1a7-7f4dafd3a1c8?source=cve · Note
• https://t.me/CVEtracker/35747 · Telegram Post
• https://twitter.com/ZeroPathLabs/status/1981993443543933142 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1982011840893763785 · Twitter Post
• https://twitter.com/cracbot/status/1983851422648295595 · Twitter Post
• https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/2.8.6/modules/woofilters/mod.php#L2056 · Note
• https://twitter.com/CVEnew/status/1981982747770946002 · Twitter Post
• https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/2.8.6/modules/woofilters/controller.php#L136 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3370655%40woo-product-filter&new=3370655%40woo-product-filter&sfp_email=&sfph_mail= · Note