The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Missing Authorization / Information Disclosure in all…
CVE-2026-11396
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Missing Authorization / Information Disclosure in all versions up to, and including, 3.4.6 via the 'filterSettings[defaultquery]' parameter of the 'filtersFrontend' AJAX action. The handler is registered as 'wpajaxnoprivfiltersFrontend' and performs no capability or nonce check; raw POST data is JSON-decoded into $filterSettings and the attacker-controlled 'defaultquery' array is unconditionally arraymerge()'d into the WPQuery arguments, overriding the plugin's safe defaults (most notably poststatus, posttype, postsperpage, and nopaging). This makes it possible for unauthenticated attackers to enumerate non-public WooCommerce products (draft, future, pending) — including their count and rendered listing markup — and to force unbounded queries that load all products in a single request.
Assessment
- CVSS
- 5.3 (v3.1)
- Severity
- Medium
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 31 October 2026
- Last updated
- 31 October 2026
- Affected
- woobewoo
- Assigner
- Wordfence
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
At the source
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f2b51837-5925-497f-bdb8-c32f9011830b?source=cve
- https://plugins.trac.wordpress.org/browser/woo-product-filter/trunk/modules/woofilters/controller.php#L864
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3757178%40woo-product-filter&new=3757178%40woo-product-filter
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-11396