CVE-2026-11396 in Product Filter for WooCommerce by WBW Plugin
Summary
by MITRE • 10/31/2026
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Missing Authorization / Information Disclosure in all versions up to, and including, 3.4.6 via the 'filterSettings[default_query]' parameter of the 'filtersFrontend' AJAX action. The handler is registered as 'wp_ajax_nopriv_filtersFrontend' and performs no capability or nonce check; raw POST data is JSON-decoded into $filterSettings and the attacker-controlled 'default_query' array is unconditionally array_merge()'d into the WP_Query arguments, overriding the plugin's safe defaults (most notably post_status, post_type, posts_per_page, and nopaging). This makes it possible for unauthenticated attackers to enumerate non-public WooCommerce products (draft, future, pending) — including their count and rendered listing markup — and to force unbounded queries that load all products in a single request.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The Product Filter for WooCommerce plugin by WBW contains a critical security flaw affecting versions up to 3.4.6, classified under CWE-862 Missing Authorization and CWE-200 Information Disclosure. This vulnerability stems from the improper handling of input data within the filtersFrontend AJAX action handler, which is registered using the wp_ajax_nopriv hook. The use of this specific hook indicates that the endpoint is intended to be accessible without authentication, yet it fails to implement any additional access controls or nonce verification mechanisms to ensure that the request originates from a legitimate source and adheres to expected operational constraints.
The technical root cause lies in how the plugin processes the filterSettings[default_query] parameter sent via POST requests. The handler decodes raw JSON data directly into an array without validating its structure or content against allowed values. It then performs an unconditional array merge operation, injecting attacker-controlled parameters into the core WordPress WP_Query arguments. This process effectively overrides safe defaults established by the plugin and WordPress itself, specifically targeting critical query variables such as post_status, post_type, posts_per_page, and nopaging. By manipulating these variables, an unauthenticated actor can fundamentally alter the behavior of database queries executed on behalf of the application.
The operational impact of this vulnerability is severe, allowing for both information disclosure and potential denial of service through resource exhaustion. Attackers can exploit the ability to modify post_status to enumerate products that are not publicly visible, including those in draft, future, or pending states. This exposes sensitive business data such as upcoming product launches, internal pricing structures, and inventory levels that should remain hidden from public view. Furthermore, by setting posts_per_page to a high value or enabling nopaging, attackers can force the server to load all products into memory during a single request. This unbounded query execution consumes significant database resources and PHP memory, potentially leading to service degradation or complete application downtime for legitimate users.
From an offensive security perspective, this vulnerability aligns with ATT&CK techniques related to Discovery and Impact. The enumeration of non-public content corresponds to T1087 Account Discovery or general system information gathering, while the unbounded query execution relates to resource exhaustion attacks that can disrupt service availability. The lack of input validation and authorization checks represents a fundamental failure in secure coding practices, allowing external actors to bypass intended access boundaries and manipulate backend logic through standard HTTP requests.
Mitigation strategies must focus on immediate remediation and long-term security hardening. Administrators should update the Product Filter for WooCommerce plugin to version 3.4.7 or later where this issue has been addressed. In cases where updating is not immediately feasible, temporary mitigations include restricting access to the filtersFrontend AJAX endpoint via web server configuration by validating referrer headers or implementing IP whitelisting if applicable. Additionally, developers should ensure that all AJAX handlers implement strict capability checks and nonce verification before processing any input data. Input validation must be enforced to whitelist allowed values for query parameters rather than merging arbitrary user-supplied arrays into core system objects. Regular security audits and static code analysis tools can help identify similar patterns of insecure direct object references or improper access control in future development cycles.