CVE-2026-32554: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in WBW WooBeWoo Product Filter Pro

CVE-2026-32554 is an unauthenticated SQL Injection vulnerability in WooBeWoo Product Filter Pro affecting all versions up to 3.1.8. The vulnerability arises from improper neutralization of special elements used in SQL commands (CWE-89), enabling remote attackers to execute SQL injection attacks without authentication. The CVSS v3.1 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. The impact includes high confidentiality loss and low availability impact. No official patch or remediation level has been provided yet, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information from the database (high confidentiality impact). The attack requires no authentication and can be performed remotely, increasing the risk. The availability impact is low, meaning the service may experience some disruption but is not the primary concern. Integrity impact is not indicated, so data modification is not confirmed. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor the vendor's communications for updates. Until a patch is available, consider applying temporary mitigations such as restricting access to the vulnerable component or employing Web Application Firewalls (WAF) with SQL injection protections tailored to this product.