EUVD-2026-14730
GHSA-r73c-85q5-vm33
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents a high real-world risk despite a moderate CVSS score of 6.5. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) correctly identifies it as network-accessible with low attack complexity and no privileges required, but the integrity and availability impact ratings (Low each) understate the practical damage—permanent deletion of all filter configurations is functionally equivalent to high availability impact in business terms. The attack is unauthenticated and requires no user interaction, making the true barrier to exploitation near zero. While specific EPSS score and KEV inclusion status are not provided in the intelligence sources, the presence of detailed vulnerability tracking via Wordfence indicates this is an actively monitored threat. The existence of trac.wordpress.org references to specific vulnerable code paths (frame.php lines 416 and 280, controller.php line 99, table.php line 345) suggests proof-of-concept exploitation would be straightforward for any moderately skilled attacker. The SSVC decision framework would likely classify this as exploitable and automatable with high technical impact (data destruction), warranting immediate patching despite the moderate CVSS number. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a POST request to the WordPress admin-ajax.php endpoint with parameters action=delete and crafted payload targeting the filter table deletion method. Due to the wp_ajax_nopriv_ hook registering the handler without capability verification and the magic method forwarding the call through to the model layer where havePermissions() defaults to true, the request succeeds without any authentication. Within seconds, the attacker's single HTTP request truncates the entire wp_wpf_filters table, permanently destroying all filter configurations for the site's WooCommerce product listings. The site owner discovers the issue only when customers report missing product filters, resulting in lost sales and emergency remediation work. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 24, 2026
The Product Filter for WooCommerce by WBW plugin for WordPress (versions up to 3.1.2) contains a critical authentication bypass vulnerability that allows unauthenticated attackers to permanently delete all filter configurations by truncating the wp_wpf_filters database table. The vulnerability stems from the plugin's MVC framework registering unauthenticated AJAX handlers without capability checks, combined with a magic method that forwards calls to the model layer and a permission check that defaults to true. An attacker can exploit this with a single crafted AJAX request, resulting in complete data loss and service disruption for WooCommerce installations using this plugin.
RemediationAI
Immediately upgrade the Product Filter for WooCommerce by WBW plugin to version 3.1.3 or later, which addresses the capability check vulnerability. Users should verify the upgrade via the WordPress plugin dashboard and confirm the version number matches the patched release documented in the repository changeset at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3487143%40woo-product-filter%2Ftrunk&old=3479545%40woo-product-filter%2Ftrunk&sfp_email=&sfph_mail=#file2. Until patching is possible, consider temporarily disabling the plugin if filter functionality is not critical, restricting AJAX requests at the web application firewall level to block requests with action=delete parameters, or implementing network-level access controls to limit WordPress admin-ajax.php access to trusted sources. Additionally, restore the wp_wpf_filters table from recent backups if it has been truncated, and review database audit logs for unauthorized AJAX requests from unknown IP addresses.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the Product Filter for WooCommerce by WBW plugin (identified via CPE cpe:2.3:a:woobewoo:product_filter_for_woocommerce_by_wbw:*:*:*:*:*:*:*:*), specifically within its custom MVC framework implementation. The root cause is classified as CWE-862 (Missing Authorization), manifesting through three chained weaknesses: first, the frame.php file registers AJAX handlers using wp_ajax_nopriv_ hooks without verifying user capabilities, allowing unauthenticated requests; second, the base controller class implements a __call() magic method that dynamically forwards undefined method calls to the model layer, enabling direct model manipulation; third, the havePermissions() method in the model defaults to returning true when no explicit permissions are defined. This combination allows an unauthenticated user to invoke arbitrary model methods via AJAX with action=delete parameter, directly targeting the table.php file's truncate functionality on the wp_wpf_filters table. The vulnerability affects the WordPress plugin ecosystem where capability checks (using current_user_can()) are standard security requirements but were bypassed through the framework's design.
Know when Product Filter For Woocommerce By Wbw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check in all versions up to, and including, 3.1.2. This is due to the plugin's MVC framework dynamically registering unauthenticated AJAX handlers via wp_ajax_nopriv_ hooks without verifying user capabilities, combined with the base controller's __call() magic method forwarding undefined method calls to the model layer, and the havePermissions() method defaulting to true when no permissions are explicitly defined. This makes it possible for unauthenticated attackers to truncate the plugin's wp_wpf_filters database table via a crafted AJAX request with action=delete, permanently destroying all filter configurations.
Executive ViewAI
Organizations using Product Filter for WooCommerce by WBW should be aware of notable risk from CVE-2026-3138, a missing authorization vulnerability rated CVSS 6.5. Attackers could gain access beyond their authorized level. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
SQL injection in Product Filter for WooCommerce by WBW plugin versions below 3.1.3 allows unauthenticated remote attacke
Reflected cross-site scripting in the Product Filter for WooCommerce by WBW WordPress plugin affects every release up to
Reflected Cross-Site Scripting in the Product Filter for WooCommerce by WBW WordPress plugin (woobewoo) allows unauthent
WBW Product Filter for WooCommerce through version 3.4.6 lets unauthenticated remote attackers enumerate draft, future a
Exploit-DB