CVE-2026-95601 is an SQL Injection vulnerability (CWE-89) in the Product Filter by WBW plugin versions up to 3.1.7. The vulnerability allows unauthenticated attackers to inject malicious SQL commands, which can compromise the confidentiality of the database and cause limited availability issues. The CVSS v3.1 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and scope changed. No vendor advisory or patch information is currently available.

The vulnerability can be exploited remotely without authentication, allowing attackers to execute arbitrary SQL commands. This can lead to disclosure of sensitive data (high confidentiality impact) and partial disruption of service (low availability impact). Integrity impact is not indicated. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected plugin or applying web application firewall rules to detect and block SQL injection attempts targeting this plugin.