Introduction
Attackers can extract sensitive customer and administrative data from vulnerable WooCommerce stores using a single unauthenticated web request. Product Filter by WBW is a WordPress plugin with over 50,000 active installations and more than 1.8 million downloads, and many e-commerce sites use it for advanced product filtering. CVE-2025-8416 exposes these sites to SQL Injection attacks through a flaw in the filtersDataBackend parameter, which puts them at significant risk of data compromise and regulatory exposure.
Technical information
CVE-2025-8416 comes from insufficient escaping and missing parameterization in SQL queries built from the filtersDataBackend parameter. The plugin's AJAX endpoints take this user-supplied parameter and place it directly into SQL statements without proper sanitization. An unauthenticated attacker can therefore inject arbitrary SQL code by changing this parameter in an HTTP request.
The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Exploitation does not require authentication or special privileges. Attackers can use time-based blind SQL Injection techniques. They inject payloads that cause conditional delays in database responses, which lets them infer database content even if the results are not returned directly.
These public code references point to the affected logic:
The vulnerable code concatenates user input from filtersDataBackend directly into SQL queries instead of using WordPress's recommended $wpdb->prepare() function for safe query construction. An attacker can then craft a request such as:
filtersDataBackend=1' AND SLEEP(5) AND '1'='1
If the database executes the query with the injected SLEEP function, the server's response is delayed. That delay confirms the injection and lets attackers extract data incrementally.
Affected systems and versions
- Product Filter by WBW for WordPress
- All versions up to and including 2.9.7
- The vulnerability is present in default plugin configurations
Vendor security history
WooBeWoo has a history of security issues in Product Filter by WBW:
- CVE-2025-2317: Time-based SQL Injection via filtersDataBackend (versions up to 2.7.9)
- CVE-2025-11269: Missing authorization allowing unauthenticated settings updates (versions up to 3.0.0)
The vendor has released patches for these vulnerabilities, and version 2.9.8 fixes CVE-2025-8416. Similar flaws keep recurring, though, which suggests ongoing problems in the vendor's secure coding and review processes.
