External risk intelligence

WooBeWoo Product Filter Pro SQL Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-39496

The vulnerability exists in a WordPress plugin designed for product filtering on e-commerce websites. Such plugins are explicitly intended to be accessed by public users browsing an online store's storefront, making the affected interface a common, internet-facing component of a web application's deployment.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical SQL injection vulnerability identified in the WooBeWoo Product Filter Pro software. This type of flaw could allow an attacker to manipulate database queries, potentially leading to unauthorized access or modification of sensitive information. The main concern is confirming if this specific software is in use and, if so, understanding the potential exposure.

Database commands can be manipulated.
Concerns about potential data compromise.
Confirm relevance and assess your exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted SQL queries through the product filter feature of the WooBeWoo Product Filter Pro plugin. This could allow them to access and manipulate the website's database, potentially leading to unauthorized data exposure or modification.

No authentication required.
Malicious SQL query via filter.
Database compromise and data leakage.

Live Threat

Current exploitation, exposure, and threat context

An SQL Injection vulnerability in WooBeWoo Product Filter Pro could allow attackers to manipulate database queries, potentially exposing sensitive information stored within the WordPress database. This could occur when the plugin fails to properly sanitize user-supplied input before incorporating it into SQL commands.

Sensitive database information could be exposed.
Attackers exploit unsanitized user input.
Unauthorized data access and potential modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in WooBeWoo Product Filter Pro likely impacts e-commerce sites using the plugin, making the application owner or the team managing the e-commerce platform primarily responsible for remediation. The initial practical step involves identifying all instances of the affected plugin, confirming their exposure to the internet, and then assessing business criticality to prioritize actions.

Application owners and platform teams.
Verify plugin instances and internet exposure.
Plan and coordinate vendor-supported updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WooBeWoo Product Filter Pro plugin used for?

This software is a WordPress plugin designed for e-commerce websites. It adds product filtering functionality to online storefronts, allowing visitors to sort and find items easily. Because it resides on the customer-facing side of a shop, it handles user interactions directly on the website.

How does this CVE-2025-39496 SQL injection vulnerability work?

The vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. It happens when the plugin fails to properly clean or sanitize user-supplied input before using it in database queries. This allows an attacker to inject their own malicious SQL commands, potentially tricking the database into revealing or modifying information it should keep secure.

Do I need to be logged in to trigger this SQL injection?

No, authentication is not required to trigger this flaw. The vulnerability is exploited by sending specially crafted queries through the plugin's filter interface. Simply interacting with the filter functions on the site is sufficient for an attacker; the bug does not require any administrative or user-level access to the WordPress backend.

Is my website at risk if I use this plugin?

According to Halo Surface Signal, this plugin is designed for public-facing product filtering on e-commerce sites, meaning the affected interface is inherently internet-facing. If your site uses an affected version, it is likely exposed to remote attackers who can reach the filter interface over the network without needing special permissions.

When should I take action for CVE-2025-39496?

You should begin by verifying if you have the affected plugin installed in your WordPress environment. Locate all instances of WooBeWoo Product Filter Pro and confirm if they are running a version prior to 2.9.6. Once identified, prioritize these instances based on your site's business criticality and coordinate with the vendor to apply the necessary updates.

References

patchstack.com/database/wordpress/plugin/woofilter-pro/vulnerability…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.