CVE-2026-39494: WordPress Product Filter by WBW plugin <= 3.1.2 - SQL Injection vulnerability
Published Jun 11, 2026
·Updated
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW allows Blind SQL Injection.
This issue affects Product Filter by WBW: from n/a through 3.1.2.
Affected Software
1 affected component
WBW Product Filter by WBW<=3.1.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/product-filter-by-wbwto a version that resolves this vulnerability.Fixed in 3.1.3
Event History
Jun 11, 2026
CVE Published
via MITRE·09:05 PM
Data Sourced
via MITRE·09:05 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·10:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-39494?
CVE-2026-39494 has a critical severity rating of 9.3.
2
What type of vulnerability is CVE-2026-39494?
CVE-2026-39494 is an SQL Injection vulnerability.
3
How do I fix CVE-2026-39494?
To fix CVE-2026-39494, update the WordPress Product Filter by WBW Plugin to version 3.1.3 or later.
4
Which versions of the product are affected by CVE-2026-39494?
CVE-2026-39494 affects Product Filter by WBW versions from n/a through 3.1.2.
5
What does the SQL Injection in CVE-2026-39494 allow an attacker to do?
The SQL Injection in CVE-2026-39494 allows for Blind SQL Injection attacks.