The Product Filter for WooCommerce by WBW plugin suffers from a time-based SQL Injection vulnerability due to improper neutralization of special elements in the filtersDataBackend parameter. This parameter is not properly escaped or prepared in SQL queries, enabling unauthenticated attackers to append malicious SQL commands. The vulnerability affects all versions up to 2.7.9 and can be exploited to extract sensitive information from the underlying database. The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, no privileges required, and no user interaction needed.

Successful exploitation allows unauthenticated attackers to conduct time-based SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not impact data integrity or availability directly but compromises confidentiality. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin functionality to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.