What is the CVSS score of CVE-2026-3138?

CVE-2026-3138 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3138?

Organizations using Product Filter for WooCommerce by WBW should be aware of notable risk from CVE-2026-3138, a missing authorization vulnerability rated CVSS 6.5.

How to fix or mitigate CVE-2026-3138?

Within 30 days: Identify affected systems running for WordPress is vulnerable to unauthorized data loss due to and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-3138

EUVD-2026-14730 MEDIUM

Missing Authorization (CWE-862)

2026-03-24 Wordfence

GHSA-r73c-85q5-vm33

WordPress Authentication Bypass

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 24, 2026 - 05:15 euvd

EUVD-2026-14730

Analysis Generated

Mar 24, 2026 - 05:15 vuln.today

CVE Published

Mar 24, 2026 - 04:27 nvd

MEDIUM 6.5

DescriptionCVE.org

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check in all versions up to, and including, 3.1.2. This is due to the plugin's MVC framework dynamically registering unauthenticated AJAX handlers via wp_ajax_nopriv_ hooks without verifying user capabilities, combined with the base controller's __call() magic method forwarding undefined method calls to the model layer, and the havePermissions() method defaulting to true when no permissions are explicitly defined. This makes it possible for unauthenticated attackers to truncate the plugin's wp_wpf_filters database table via a crafted AJAX request with action=delete, permanently destroying all filter configurations.

AnalysisAI

The Product Filter for WooCommerce by WBW plugin for WordPress (versions up to 3.1.2) contains a critical authentication bypass vulnerability that allows unauthenticated attackers to permanently delete all filter configurations by truncating the wp_wpf_filters database table. The vulnerability stems from the plugin's MVC framework registering unauthenticated AJAX handlers without capability checks, combined with a magic method that forwards calls to the model layer and a permission check that defaults to true. An attacker can exploit this with a single crafted AJAX request, resulting in complete data loss and service disruption for WooCommerce installations using this plugin.

Technical ContextAI

The vulnerability exists in the Product Filter for WooCommerce by WBW plugin (identified via CPE cpe:2.3:a:woobewoo:product_filter_for_woocommerce_by_wbw:*:*:*:*:*:*:*:*), specifically within its custom MVC framework implementation. The root cause is classified as CWE-862 (Missing Authorization), manifesting through three chained weaknesses: first, the frame.php file registers AJAX handlers using wp_ajax_nopriv_ hooks without verifying user capabilities, allowing unauthenticated requests; second, the base controller class implements a __call() magic method that dynamically forwards undefined method calls to the model layer, enabling direct model manipulation; third, the havePermissions() method in the model defaults to returning true when no explicit permissions are defined. This combination allows an unauthenticated user to invoke arbitrary model methods via AJAX with action=delete parameter, directly targeting the table.php file's truncate functionality on the wp_wpf_filters table. The vulnerability affects the WordPress plugin ecosystem where capability checks (using current_user_can()) are standard security requirements but were bypassed through the framework's design.

RemediationAI

Immediately upgrade the Product Filter for WooCommerce by WBW plugin to version 3.1.3 or later, which addresses the capability check vulnerability. Users should verify the upgrade via the WordPress plugin dashboard and confirm the version number matches the patched release documented in the repository changeset at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3487143%40woo-product-filter%2Ftrunk&old=3479545%40woo-product-filter%2Ftrunk&sfp_email=&sfph_mail=#file2. Until patching is possible, consider temporarily disabling the plugin if filter functionality is not critical, restricting AJAX requests at the web application firewall level to block requests with action=delete parameters, or implementing network-level access controls to limit WordPress admin-ajax.php access to trusted sources. Additionally, restore the wp_wpf_filters table from recent backups if it has been truncated, and review database audit logs for unauthorized AJAX requests from unknown IP addresses.