CVE-2025-39496CWE-89sql-injection

CVE-2025-39496

Critical · published August 28, 2025

CVSS v3.1
9.3
EPSS
0%
Percentile
21.6
In the wild
Unconfirmed
What it is

🔥 A sneaky SQL injection lurks in WBW WooBeWoo Product Filter Pro versions before 2.9.6, and it's ready to act like a magician pulling rabbits out of hats — only this time, it's your data disappearing! 🎩✨ Think of it like a restaurant where the chef accepts orders without checking for allergens. If someone sneaks in a dangerous ingredient, it could lead to some disastrous meals — in this case, your database is the kitchen, and the SQL injection is the hidden allergy! An attacker could exploit this vulnerability to execute malicious SQL commands, potentially gaining access to sensitive data, altering it, or even deleting everything! Imagine someone slipping into the back of the restaurant and tampering with every dish before it reaches the table — absolutely devastating!

Put simply

Think of it like a restaurant where the chef accepts orders without checking for allergens. If someone sneaks in a dangerous ingredient, it could lead to some disastrous meals — in this case, your database is the kitchen, and the SQL injection is the hidden allergy! This vulnerability allows attackers to inject malicious SQL statements through improperly sanitized input, bypassing intended database security controls in WooBeWoo Product Filter Pro.

What to do

An attacker could exploit this vulnerability to execute malicious SQL commands, potentially gaining access to sensitive data, altering it, or even deleting everything! Imagine someone slipping into the back of the restaurant and tampering with every dish before it reaches the table — absolutely devastating! Update WooBeWoo Product Filter Pro to version 2.9.6 or later immediately to close this critical hole. Also, consider implementing input validation and prepared statements to bolster defenses against future SQL injections. You've got this! Follow these steps, and you'll have your security locked down tighter than a vault! 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00301 · 21.6th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-08-28T16:15Z
References (1)
EPSS history
Timeline
  • 28 AUG 11:41Z
    WordPress WooBeWoo Product Filter Pro plugin < 2.9.6 - SQL Injection vulnerability
    cvelistv5