WBW Product Filter CVE-2026-11396

No special conditions beyond the plugin being installed and active - remote unauthenticated exploitation works against default configurations of Product Filter for WooCommerce by WBW (all versions through 3.4.6), because the vulnerable endpoint is registered via the 'wp_ajax_nopriv_filtersFrontend' hook that is reachable without login. The specific trigger is a POST to the 'filtersFrontend' AJAX action carrying a JSON 'filterSettings[default_query]' array; supplying keys such as post_status, post_type, posts_per_page, or nopaging overrides the plugin's safe defaults. Limiting factors: impact is confined to read-only disclosure of non-public product data (draft/future/pending counts and rendered listing markup) and to resource-heavy unbounded queries; there is no authentication requirement, no user interaction, and no write or code-execution capability.

Signals are mostly aligned toward a moderate, non-emergency priority. The CVSS 3.1 base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N): remote, network-reachable, no authentication, no user interaction, low complexity, but only a Low confidentiality impact and no integrity or availability impact - consistent with CWE-862 Missing Authorization leading to information disclosure rather than code execution. The vuln.today decision label is 'this_month', indicating a routine patch cadence rather than act_now/emergency. No CISA KEV listing and no EPSS score are present in the input, so there is no evidence of active exploitation or a high predicted exploitation probability; treat both as unknown rather than low. No public exploit code is referenced (the links are the Wordfence advisory, the vulnerable source line, and the fix changeset - not a weaponized PoC). The realistic risk is that trivially-scriptable unauthenticated access makes casual enumeration of non-public WooCommerce products easy, but the ceiling is bounded: it exposes draft/future/pending product data and listing markup, not credentials, write access, or RCE. This is a genuine but limited data-exposure issue - higher operational nuisance than the 5.3 suggests because it is unauthenticated and low-complexity, yet capped by the Low confidentiality-only impact.

An unauthenticated attacker sends a crafted POST to the site's admin-ajax.php invoking the 'filtersFrontend' action with a JSON 'filterSettings[default_query]' payload that sets post_status to draft/pending/future and nopaging to true. The plugin array_merge()'s this into WP_Query without any capability or nonce check, returning the count and rendered listing markup for non-public WooCommerce products, and can be forced to load all products in one request. No public exploit code is identified at time of analysis, though the vulnerable handler and the fix changeset are publicly documented.