This vulnerability (CVE-2026-39494) in WBW Plugins Product Filter by WBW is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). It allows Blind SQL Injection attacks, which can lead to unauthorized disclosure of sensitive data and partial denial of service. The affected versions include all versions up to 3.1.2. The CVSS 3.1 vector indicates the attack can be performed remotely without authentication and with low complexity, impacting confidentiality and availability. No vendor advisory or patch information is provided, and no known exploits are reported in the wild as of the published date.

Successful exploitation of this vulnerability can allow an attacker to perform Blind SQL Injection, potentially leading to unauthorized access to sensitive information stored in the database and partial denial of service. The CVSS score of 9.3 reflects critical impact on confidentiality and availability. There is no indication of integrity impact. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No temporary or official fixes are currently documented.