SQL Injection in WPFactory Product Filter Plugin

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-112866 represents a critical SQL injection vulnerability in the WPFactory Product Filter by WBW plugin (versions through 3.4.6), affecting WordPress sites that rely on this popular e-commerce filtering tool. SQL injection vulnerabilities allow attackers to manipulate database queries by injecting malicious SQL commands, potentially leading to unauthorized data access, modification, or deletion. This particular variant uses blind SQL injection techniques, where attackers extract data without seeing direct query results, making detection more challenging. Any WordPress installation using the vulnerable plugin versions is at risk, particularly those processing sensitive customer data or financial transactions.

Casky's 323 mapped skills leverage Claude AI with extended reasoning to detect the attack patterns underlying this CVE by analyzing both the reconnaissance and execution phases. For MITRE ATT&CK technique TA0001 (Reconnaissance), practitioners would see skills identifying database fingerprinting attempts and input validation probing before exploitation. For TA0043 (Resource Development), skills detect the crafting of blind SQL payloads and timing-based injection techniques used to exfiltrate data. The platform's security skills would flag suspicious parameter manipulation in WPFactory filter requests, unusual database query timing patterns, and encoded or obfuscated SQL commands in plugin inputs. Practitioners examining Casky findings would observe detailed attack chain analysis showing how improperly neutralized special characters in SQL commands (CWE-89) create exploitable conditions, enabling them to patch vulnerable versions and implement input validation controls before blind SQL queries compromise their databases.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-112866.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-112866

Casky has 323 skills that investigate the attack patterns behind CVE-2026-112866. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn