PT-2026-27327 · Woobewoo · Product Filter For Woocommerce By Wbw

Youssef Elouaer · Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-3138

Mitre

CVSS v3.1

6.5

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check in all versions up to, and including, 3.1.2. This is due to the plugin's MVC framework dynamically registering unauthenticated AJAX handlers via wp ajax nopriv hooks without verifying user capabilities, combined with the base controller's call() magic method forwarding undefined method calls to the model layer, and the havePermissions() method defaulting to true when no permissions are explicitly defined. This makes it possible for unauthenticated attackers to truncate the plugin's wp wpf filters database table via a crafted AJAX request with action=delete, permanently destroying all filter configurations.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-3138

Affected Products

Product Filter For Woocommerce By Wbw

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-3138 · Security Note
• https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.1.0/classes/controller.php#L99 · Note
• https://wordpress.org/plugins/woo-product-filter · Note
• https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.1.0/classes/frame.php#L280 · Note
• https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.1.0/classes/table.php#L345 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3487143%40woo-product-filter%2Ftrunk&old=3479545%40woo-product-filter%2Ftrunk&sfp_email=&sfph_mail=#file2 · Note
• https://plugins.trac.wordpress.org/browser/woo-product-filter/tags/3.1.0/classes/frame.php#L416 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/085a4fae-c3f4-45f9-ab30-846c6297d04e?source=cve · Note