The Product Filter for WooCommerce by WBW plugin suffers from an SQL Injection vulnerability (CWE-89) due to insufficient escaping and lack of prepared statements for the 'filtersDataBackend' parameter. This flaw allows unauthenticated remote attackers to append malicious SQL code to existing queries, potentially exposing sensitive data from the backend database. The vulnerability affects all plugin versions up to 2.9.7. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or official fix information is currently available.

Successful exploitation enables unauthenticated attackers to extract sensitive information from the plugin's database by injecting arbitrary SQL commands. The vulnerability does not impact integrity or availability according to the CVSS vector, but confidentiality is rated high. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin to prevent exploitation. Monitoring vendor channels for updates is recommended.