CVE-2025-13314
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2Description
The Product Filtering by Categories, Tags, Price Range for WooCommerce - Filter Plus plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.1.6 due to a missing capability check on the 'filter_save_settings' and 'add_filter_options' AJAX actions. This makes it possible for unauthenticated attackers to modify the plugin's settings and create arbitrary filter options.
Analysis
Unauthenticated attackers can modify plugin settings and create arbitrary filter options in the Filter Plus plugin for WordPress (versions up to 1.1.6) due to missing capability checks on AJAX actions 'filter_save_settings' and 'add_filter_options'. This allows unauthorized data modification with no confidentiality impact but enables attackers to alter product filtering functionality without authentication. The vulnerability has a low EPSS score (0.08%, 23rd percentile) despite network accessibility, indicating limited real-world exploitation likelihood.
Technical Context
The Filter Plus plugin for WordPress implements AJAX endpoints for managing product filter settings but fails to validate user capabilities before processing requests. The vulnerability stems from CWE-862 (Missing Authorization), where the AJAX actions lack WordPress nonce verification and capability checks (such as current_user_can() calls) required to ensure only authorized administrators can modify settings. The affected code paths in action.php lines 23, 28, and 82 handle filter option creation and settings persistence without proper access controls. WordPress's AJAX handler processes requests from unauthenticated users if the action is registered for 'wp_ajax_nopriv' or if the default AJAX registration fails to restrict access.
Affected Products
The Filter Plus plugin for WordPress in all versions up to and including 1.1.6 is affected. This is a WordPress plugin hosted on the official WordPress.org plugin repository. The vulnerability was present in version 1.1.5 (as referenced in the plugin repository tags) and remediated in version 1.1.7 or later. The plugin's CPE is not provided in standard form, but it is identified as 'filter-plus' in the WordPress plugin directory.
Remediation
Update the Filter Plus plugin to version 1.1.7 or later immediately. Site administrators should navigate to the WordPress plugin dashboard, locate the Filter Plus plugin, and select the update option. Verify the update completes successfully and that the plugin is running the patched version by checking the plugin details. If automatic updates are not enabled, manually download version 1.1.7 or later from the official WordPress plugin repository (plugins.trac.wordpress.org) and upload it via SFTP or the WordPress admin upload interface. As a temporary workaround pending updates, restrict AJAX access through web server configuration if technically feasible, though this may disrupt plugin functionality and is not a long-term solution. Review audit logs to determine if settings were modified during exposure.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today