Product Filter for WooCommerce by WBW SQL Injection Vulnerability

A SQL injection vulnerability has been identified in the Product Filter for WooCommerce by WBW WordPress plugin, affecting versions prior to 3.1.3. The vulnerability arises because the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL statement. This oversight allows unauthenticated users to execute SQL injection attacks.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to the database. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the WordPress site.

Reproduction

To reproduce this vulnerability, send a POST request to 'wp-admin/admin-ajax.php' with the action 'drawFilterAjax'. Include the 'pl' parameter set to 'wpf' and the 'mod' parameter set to 'woofilters'. The 'settings[filters][order]' parameter can be crafted to include a SQL injection payload, such as a subquery that uses SQL functions like 'SLEEP()' to demonstrate the injection.

Remediation

Users are advised to update the Product Filter for WooCommerce by WBW WordPress plugin to version 3.1.3 or later.