Low Severity
CVE-2026-112866
Published: Oct 31, 2026
# CVE-2026-112866 - Product Filter by WBW Unauthenticated SQL Injection Validation Lab
Security-research material for reproducing and validating **CVE-2026-112866**:
Product Filter by WBW (woo-product-filter) <= 3.4.6 lets an unauthenticated
caller drive the frontend filter AJAX flow (`woobewoo_pf_filters_frontend`)
with fully attacker-supplied filter definitions, URL context and - in 3.4.6 -
no nonce. The filter's `f_list` attribute slug is used raw as a taxonomy,
matched against the attacker-controlled `currenturl` query string, and the
matched parameter name becomes the temporary-table name postfix, which is
interpolated into `DROP`/`CREATE TEMPORARY TABLE` statements without
identifier sanitization.
- **Affected:** Product Filter by WBW <= 3.4.6
- **Fixed:** 3.4.7 (`check_ajax_referer()` + `sanitize_html_class()` +
`resolve_filter_taxonomy()` - a `^[A-Za-z0-9_.%\-]{1,200}$` whitelist that
rejects the payload before any SQL is built - plus `createTemporaryTable()`
hardening)
- **CVSS 3.1:** 9.3 per Patchstack, required privilege: unauthenticated
- **Sink:** `createTemporaryTable()` - `DROP/CREATE TEMPORARY TABLE
\`wpf_temp_table_<postfix>\`` raw identifier interpolation
(`modules/woofilters/class-woobewoo-pf-woofilters.php:3725/3730` in 3.4.6)
> **Use only on systems you own or are explicitly authorized to test.** The
> PoC is a structural oracle (the filter response's `exists` member flips
> between a JSON object and a broken JSON array with only the injected
> backtick). No data extracted, no persistent changes - only ephemeral
> TEMPORARY tables inside the request.
## Verdict
**Status: proven in the supplied lab.**
woo-product-filter 3.4.6 (WordPress 7.1.2, WooCommerce 11.2.1, nopriv AJAX):
```
f_list "pa_color" : filter_state.exists = {"pa_color": {term ids: counts}}
(benign control: endpoint fully functional, terms counted)
f_list "color`" : filter_state.exists = [] (JSON empty array)
(DROP TEMPORA