CVE-2026-3138 PUBLISHED

Product Filter for WooCommerce by WBW <= 3.1.2 - Missing Authorization to Unauthenticated Filter Data Deletion via TRUNCATE TABLE

Assigner: Wordfence
Reserved: 24.02.2026 Published: 24.03.2026 Updated: 24.03.2026

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check in all versions up to, and including, 3.1.2. This is due to the plugin's MVC framework dynamically registering unauthenticated AJAX handlers via wp_ajax_nopriv_ hooks without verifying user capabilities, combined with the base controller's __call() magic method forwarding undefined method calls to the model layer, and the havePermissions() method defaulting to true when no permissions are explicitly defined. This makes it possible for unauthenticated attackers to truncate the plugin's wp_wpf_filters database table via a crafted AJAX request with action=delete, permanently destroying all filter configurations.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS Score: 6.5

Product Status

Vendor woobewoo
Product Product Filter for WooCommerce by WBW
Versions Default: unaffected
  • affected from * to 3.1.2 (incl.)

Credits

  • Youssef Elouaer finder

References

Problem Types

  • CWE-862 Missing Authorization CWE