This vulnerability (CVE-2025-39496) in WBW WooBeWoo Product Filter Pro is caused by improper neutralization of special elements used in SQL commands, classified as CWE-89 (SQL Injection). It affects all versions prior to 2.9.6. The flaw allows remote attackers to execute arbitrary SQL commands without authentication or user interaction, potentially compromising the confidentiality of the database and causing limited availability impact. The CVSS 3.1 vector indicates it is remotely exploitable over the network with low attack complexity and no privileges required. No patch or official fix details are currently available.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the affected system, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any available workarounds from the vendor or restrict access to the vulnerable component. Monitor vendor channels for updates regarding patches or mitigations.