CVE-2021-4337 in Product Filter for WooCommerce
Summary
by MITRE • 06/07/2023
Sixteen XforWooCommerce Add-On Plugins for WordPress are vulnerable to authorization bypass due to a missing capability check on the wp_ajax_svx_ajax_factory function in various versions listed below. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to read, edit, or delete WordPress settings, plugin settings, and to arbitrarily list all users on a WordPress website. The plugins impacted are: Product Filter for WooCommerce < 8.2.0, Improved Product Options for WooCommerce < 5.3.0, Improved Sale Badges for WooCommerce < 4.4.0, Share, Print and PDF Products for WooCommerce < 2.8.0, Product Loops for WooCommerce < 1.7.0, XforWooCommerce < 1.7.0, Package Quantity Discount < 1.2.0, Price Commander for WooCommerce < 1.3.0, Comment and Review Spam Control for WooCommerce < 1.5.0, Add Product Tabs for WooCommerce < 1.5.0, Autopilot SEO for WooCommerce < 1.6.0, Floating Cart < 1.3.0, Live Search for WooCommerce < 2.1.0, Bulk Add to Cart for WooCommerce < 1.3.0, Live Product Editor for WooCommerce < 4.7.0, and Warranties and Returns for WooCommerce < 5.3.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/09/2026
This vulnerability represents a critical authorization bypass flaw affecting sixteen popular WooCommerce add-on plugins for WordPress, specifically targeting the wp_ajax_svx_ajax_factory function which lacks proper capability checks. The flaw allows authenticated attackers with subscriber-level permissions or higher to execute unauthorized actions against WordPress core settings and plugin configurations. This issue falls under the CWE-863 category of Incorrect Authorization, where the application fails to properly verify that an authenticated user has sufficient privileges to perform requested operations. The vulnerability exists across multiple plugin versions, with specific affected ranges indicating that the issue was not addressed in versions prior to the listed minimums, creating a widespread exposure across the WordPress ecosystem.
The technical implementation of this flaw stems from the absence of capability validation within the AJAX handler function that processes administrative requests. When an attacker with subscriber privileges invokes the wp_ajax_svx_ajax_factory endpoint, the system fails to verify whether the user possesses the necessary administrative permissions to modify WordPress settings or access sensitive user data. This missing authorization check creates a direct pathway for privilege escalation, enabling attackers to manipulate core WordPress configurations and retrieve sensitive information through arbitrary user listing capabilities. The vulnerability operates at the application layer and can be exploited through authenticated sessions, making it particularly dangerous as it requires minimal privilege escalation to achieve significant impact.
The operational impact of this vulnerability extends beyond simple data exposure to encompass full administrative control over affected WordPress installations. Attackers can leverage this flaw to read, edit, or delete critical WordPress settings, potentially compromising website integrity and user data security. The ability to arbitrarily list all users on a website provides attackers with valuable reconnaissance information, including user roles and potential targets for further exploitation. This vulnerability directly aligns with ATT&CK technique T1078.004 for Valid Accounts and T1566.001 for Phishing, as it enables attackers to escalate privileges and gain unauthorized access to administrative functions through legitimate user accounts. The widespread nature of affected plugins means that numerous websites utilizing these add-ons are potentially exposed to this authorization bypass.
Mitigation strategies should focus on immediate plugin updates to versions that address the capability check vulnerability, with administrators prioritizing the patching of all affected plugins within the specified version ranges. The implementation of additional security measures such as role-based access controls, enhanced monitoring of AJAX endpoint usage, and regular security audits can help detect and prevent exploitation attempts. Organizations should also consider implementing web application firewalls to monitor and block suspicious AJAX requests, particularly those targeting known vulnerable endpoints. Security hardening practices including the principle of least privilege, regular security assessments, and maintaining updated security tooling are essential for protecting against similar authorization bypass vulnerabilities in the future. The vulnerability demonstrates the critical importance of proper capability validation in web applications and serves as a reminder of the potential impact when authentication checks are improperly implemented in WordPress plugins.