Read the docs
TI-2026-83478 Aliases CVE-2026-11396GHSA-xhg4-2xwf-g98x

Missing authorization in WBW Product Filter leaks non-public products

Priority LOW 30CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The Product Filter for WooCommerce by WBW plugin for WordPress, in all versions up to and including 3.4.6, performs no authorization check in its filtersFrontend AJAX action (CWE-862). Attacker-supplied query settings override the plugin's safe defaults, so the query can include draft, future and pending products. An unauthenticated remote attacker can enumerate non-public WooCommerce products, including their count and rendered listing markup, and force queries that load all products in one request.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Description from the CNA

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Missing Authorization / Information Disclosure in all versions up to, and including, 3.4.6 via the 'filterSettings[default_query]' parameter of the 'filtersFrontend' AJAX action. The handler is registered as 'wp_ajax_nopriv_filtersFrontend' and performs no capability or nonce check; raw POST data is JSON-decoded into $filterSettings and the attacker-controlled 'default_query' array is unconditionally array_merge()'d into the WP_Query arguments, overriding the plugin's safe defaults (most notably post_status, post_type, posts_per_page, and nopaging). This makes it possible for unauthenticated attackers to enumerate non-public WooCommerce products (draft, future, pending) — including their count and rendered listing markup — and to force unbounded queries that load all products in a single request.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00231 14th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
woobewooProduct Filter for WooCommerce by WBWup to 3.4.6—No fix listedCNA
  • Product Filter for WooCommerce by WBW Vendorwoobewoo Affected up to 3.4.6 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Product Filter for WooCommerce by WBW.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Timeline

  1. 2026-10-31 Threatist record created from CVE-2026-11396
  2. 2026-10-31 Alias added: GHSA-xhg4-2xwf-g98x
  3. 2026-11-06 CISA SSVC decision points changed

References

Other 3

  • TI-2024-29507 WordPress WBW Product Table PRO plugin <= 1.9.4 - Unauthenticated Arbitrary SQL Query Execution vulnerability CVSS 3.1CRITICAL 10.0
  • TI-2024-05907 Product Table by WBW <= 2.0.1 - Unauthenticated Remote Code Execution CVSS 3.1CRITICAL 9.8
  • TI-2024-12278 Product Table by WBW <= 2.1.2 - Unuthenticated SQL Injection CVSS 3.1CRITICAL 9.8
  • TI-2025-22329 WordPress WBW Product Table PRO plugin <= 2.2.6 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.3
  • TI-2025-07702 Product Filter by WBW <= 2.9.7 - Unauthenticated SQL Injection CVSS 3.1HIGH 7.5
  • TI-2025-02035 Product Filter by WBW <= 2.7.9 - Unauthenticated SQL Injection via filtersDataBackend Parameter CVSS 3.1HIGH 7.5
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences