External risk intelligence

WooBeWoo Product Filter Pro SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-32554

This vulnerability affects a WordPress plugin designed for product filtering on e-commerce websites. Such plugins are inherently intended to be part of the public-facing web interface to interact with site visitors, making them commonly reachable from the internet in standard deployments.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a popular WordPress product filtering plugin that could allow an unauthenticated attacker to inject malicious SQL code. This type of attack could potentially expose sensitive data within the affected e-commerce platforms, impacting customer trust and business operations. The main concern at this stage is confirming if our e-commerce sites utilize this specific plugin and are exposed.

Unauthenticated SQL injection in a product filter.
Enables attackers to potentially access sensitive data.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted request to a website using the affected product filter plugin. This could allow them to inject malicious SQL code into the database, potentially leading to unauthorized access or modification of sensitive data.

No authentication is needed.
Triggered by a crafted SQL injection request.
Risk of unauthorized data access or modification.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject SQL code into the system when the product filter is used. When supported by the advisory, this could lead to unauthorized access or modification of sensitive data stored within the database.

Sensitive database information.
Unauthenticated network access.
Unauthorized data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in WooBeWoo Product Filter Pro, an unauthenticated SQL injection, impacts external-facing e-commerce platforms and requires immediate attention from website owners, platform administrators, and potentially vendor management teams. The first step is to identify all instances of this plugin, confirm their exposure to the internet, and determine their business criticality to prioritize remediation efforts.

Website owners and platform administrators.
Verify plugin presence and internet exposure.
Plan risk-based remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is WooBeWoo Product Filter Pro?

It is a WordPress plugin designed to add search and filtering capabilities to e-commerce storefronts. By enabling customers to sort products by attributes like price or category, it serves as an interactive component on web pages, which is why it often sits on the public-facing side of a site.

What does CVE-2026-32554 mean by SQL injection?

This vulnerability falls under the CWE-89 weakness class. It means the software does not properly sanitize user input, allowing an attacker to insert their own commands into the database queries the plugin runs. Essentially, the plugin is tricked into executing unauthorized instructions against the site's back-end data.

How can an attacker trigger this vulnerability?

An attacker triggers the bug by sending a specifically crafted request to the web server that interacts with the filter plugin. No authentication or login is required to initiate this. It is important to note that simply visiting the site normally does not trigger the issue; the attacker must intentionally send malformed input designed to exploit the database query.

Is my website at risk from this CVE?

According to Halo Surface Signal, this plugin is intended for public-facing web interfaces, meaning instances are likely reachable from the internet. If you run an e-commerce site using this plugin version, you should assume it is exposed. The primary concern is whether your platform is accessible to external traffic, which most product filters are by design.

Do I need to take action if I use this plugin?

Yes. Your first priority is to create an inventory of all sites where this plugin is installed. Once identified, confirm which instances are accessible to the internet to prioritize your response. Work to determine your upgrade path or apply vendor-provided updates to remediate the vulnerability, ensuring you coordinate with the appropriate teams managing your e-commerce infrastructure.

References

patchstack.com/database/wordpress/plugin/woofilter-pro/vulnerability…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.