A critical SQL injection vulnerability in the Product Filter for WooCommerce plugin allows unauthenticated attackers to potentially extract sensitive database information.

The plugin fails to properly sanitize and escape input parameters before incorporating them into SQL queries. This flaw allows unauthenticated remote attackers to execute arbitrary SQL commands against the WordPress database.

The ability for an unauthenticated attacker to inject SQL commands poses a severe risk to data confidentiality. An attacker could potentially extract administrative credentials, customer information, or other sensitive data stored within the WordPress database. With a CVSS score of 8.6, this vulnerability is classified as High, reflecting the significant potential for unauthorized data exfiltration and the ease of exploitation.

Immediate Action: Update the Product Filter for WooCommerce plugin to version 3.1.3 or higher immediately to apply the vendor supplied fix.

Proactive Monitoring: Review database error logs and query logs for unusual SQL syntax or unexpected query patterns that may indicate automated injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets configured to detect and block common SQL injection patterns targeting WordPress plugins.

Public Exploit Available: Unknown.

Given the public availability of proof-of-concept materials and the high severity of SQL injection, organizations using this plugin should prioritize patching. Failure to address this vulnerability could lead to a complete compromise of the application database. Ensure that all plugin updates are verified against the vendor advisory before deployment.