CVE-2026-39494: WordPress Product Filter by WBW plugin <=…

Record summary

CVE-2026-39494 has a selected CVSS score of 9.3 (critical).

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW allows Blind SQL Injection. This issue affects Product Filter by WBW: from n/a through 3.1.2.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV: Listed · Jun 11, 2026 · VulnCheck
Reported exploitation: Observed · VulnCheck

CISA SSVC decision

ExploitationNone

AutomatableYes

Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 12, 2026 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
Product Filter by WBW Browse WBW Plugins / Product Filter by WBWwoo-product-filter Default status: unaffected	CVE List	Through 3.1.2	affected
Product Filter by WBW Browse WBW Plugins / Product Filter by WBW	VulnCheck	Version data not supplied

References

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2026-39494

patchstack.comvdb entry

https://patchstack.com/database/wordpress/plugin/woo-product-filter/vulnerability/wordpress-product-filter-by-wbw-plugin-3-1-2-sql-injection-vulnerability?_s_id=cve