Product Filter For Woocommerce By Wbw CVE-2026-3138

The vulnerability exists in the Product Filter for WooCommerce by WBW plugin (identified via CPE cpe:2.3:a:woobewoo:product_filter_for_woocommerce_by_wbw:*:*:*:*:*:*:*:*), specifically within its custom MVC framework implementation. The root cause is classified as CWE-862 (Missing Authorization), manifesting through three chained weaknesses: first, the frame.php file registers AJAX handlers using wp_ajax_nopriv_ hooks without verifying user capabilities, allowing unauthenticated requests; second, the base controller class implements a __call() magic method that dynamically forwards undefined method calls to the model layer, enabling direct model manipulation; third, the havePermissions() method in the model defaults to returning true when no explicit permissions are defined. This combination allows an unauthenticated user to invoke arbitrary model methods via AJAX with action=delete parameter, directly targeting the table.php file's truncate functionality on the wp_wpf_filters table. The vulnerability affects the WordPress plugin ecosystem where capability checks (using current_user_can()) are standard security requirements but were bypassed through the framework's design.