平台
wordpress
组件
woofilter-pro
修复版本
2.9.6
CVE-2025-39496 identifies a SQL Injection vulnerability within the WooBeWoo Product Filter Pro WordPress plugin. This flaw allows attackers to inject malicious SQL code, potentially gaining unauthorized access to the database and compromising sensitive data. The vulnerability impacts versions prior to 2.9.6, and a patch is available in version 2.9.6.
Successful exploitation of CVE-2025-39496 can have severe consequences. An attacker could leverage SQL injection to bypass authentication, retrieve sensitive user data (usernames, passwords, email addresses, order information), modify database content, or even execute arbitrary commands on the server. The blast radius extends to all users of the affected WordPress site, and the potential for data exfiltration and website defacement is high. This vulnerability shares similarities with other SQL injection flaws where attackers can manipulate database queries to gain unauthorized access.
CVE-2025-39496 was publicly disclosed on 2025-08-28. The vulnerability's criticality (CVSS 9.3) and the ease of SQL injection exploitation suggest a potential for active exploitation. While no public proof-of-concept (PoC) code has been widely reported, the availability of the vulnerability details increases the risk of exploitation by malicious actors. Its inclusion in the NVD is pending.
WordPress websites utilizing the WooBeWoo Product Filter Pro plugin, particularly those running versions prior to 2.9.6, are at significant risk. Shared hosting environments where multiple websites share the same database are especially vulnerable, as a compromise of one site could potentially impact others.
• wordpress / composer / npm:
grep -r "SELECT .* FROM" /var/www/html/wp-content/plugins/wbw-product-filter-pro/• generic web:
curl -I https://your-wordpress-site.com/wp-content/plugins/wbw-product-filter-pro/ | grep SQLdisclosure
漏洞利用状态
EPSS
0.03% (10% 百分位)
CISA SSVC
CVSS 向量
The primary mitigation for CVE-2025-39496 is to immediately upgrade WooBeWoo Product Filter Pro to version 2.9.6 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds such as input validation and sanitization on all user-supplied data used in SQL queries. Web application firewalls (WAFs) configured with SQL injection rules can also provide a layer of protection. Monitor WordPress logs for suspicious SQL queries that might indicate an attempted exploitation.
Actualice el plugin WooBeWoo Product Filter Pro a la versión 2.9.6 o superior para mitigar la vulnerabilidad de inyección SQL. Verifique que todas las instancias del plugin estén actualizadas para evitar posibles ataques. Considere implementar medidas de seguridad adicionales, como la validación de entradas, para fortalecer la protección contra futuras vulnerabilidades.
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2025-39496 is a critical SQL Injection vulnerability affecting WooBeWoo Product Filter Pro versions before 2.9.6, allowing attackers to manipulate database queries.
If you are using WooBeWoo Product Filter Pro versions earlier than 2.9.6, you are vulnerable to this SQL Injection flaw.
Upgrade WooBeWoo Product Filter Pro to version 2.9.6 or later to patch the SQL Injection vulnerability. Consider temporary workarounds if immediate upgrade is not possible.
While no widespread exploitation has been confirmed, the vulnerability's criticality and public disclosure increase the risk of exploitation.
Refer to the WooBeWoo Product Filter Pro official website or WordPress plugin repository for the latest security advisory and update information.
上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。