CVE-2026-11396: Product Filter for WooCommerce by WBW <= 3.4.6 - Missing Authorization to Unauthenticated Information Disclosure via filterSettings[default_query] Parameter

Q: Who can exploit this issue?

Any unauthenticated remote attacker can invoke the publicly registered filtersFrontend AJAX action. No account, capability, or nonce is required.

Q: What information can be exposed?

An attacker can alter the query to enumerate non-public WooCommerce products, including draft, scheduled, and pending products. The response can reveal product counts and rendered listing markup.

Q: Can this be used to affect availability?

Yes. By overriding query arguments such as posts_per_page and nopaging, an attacker can force an unbounded query that loads all products in one request.

Q: Which installations are affected?

Product Filter for WooCommerce by WBW versions through 3.4.6 are affected. The vulnerable AJAX handler is available to unauthenticated users, so exposure does not depend on having a logged-in WordPress account.

Published Oct 31, 2026

Updated

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Missing Authorization / Information Disclosure in all versions up to, and including, 3.4.6 via the 'filterSettings[defaultquery]' parameter of the 'filtersFrontend' AJAX action. The handler is registered as 'wpajaxnoprivfiltersFrontend' and performs no capability or nonce check; raw POST data is JSON-decoded into $filterSettings and the attacker-controlled 'defaultquery' array is unconditionally arraymerge()'d into the WPQuery arguments, overriding the plugin's safe defaults (most notably poststatus, posttype, postsperpage, and nopaging). This makes it possible for unauthenticated attackers to enumerate non-public WooCommerce products (draft, future, pending) — including their count and rendered listing markup — and to force unbounded queries that load all products in a single request.

Event History

Oct 31, 2026

CVE Published

via MITRE·06:44 AM

Data Sourced

via MITRE·06:44 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote attacker can invoke the publicly registered filtersFrontend AJAX action. No account, capability, or nonce is required.

What information can be exposed?

An attacker can alter the query to enumerate non-public WooCommerce products, including draft, scheduled, and pending products. The response can reveal product counts and rendered listing markup.

Can this be used to affect availability?

Yes. By overriding query arguments such as posts_per_page and nopaging, an attacker can force an unbounded query that loads all products in one request.

Which installations are affected?

Product Filter for WooCommerce by WBW versions through 3.4.6 are affected. The vulnerable AJAX handler is available to unauthenticated users, so exposure does not depend on having a logged-in WordPress account.

CVE-2026-11396: Product Filter for WooCommerce by WBW <= 3.4.6 - Missing Authorization to Unauthenticated Information Disclosure via filterSettings[default_query] Parameter

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

Can this be used to affect availability?

Which installations are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

Can this be used to affect availability?

Which installations are affected?