CVE-2026-3138: Product Filter for WooCommerce by WBW <= 3.1.2 - Missing Authorization to Unauthenticated Filter Data Deletion via TRUNCATE TABLE
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check in all versions up to, and including, 3.1.2. This is due to the plugin's MVC framework dynamically registering unauthenticated AJAX handlers via wpajaxnopriv hooks without verifying user capabilities, combined with the base controller's call() magic method forwarding undefined method calls to the model layer, and the havePermissions() method defaulting to true when no permissions are explicitly defined. This makes it possible for unauthenticated attackers to truncate the plugin's wpwpffilters database table via a crafted AJAX request with action=delete, permanently destroying all filter configurations.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3138?
CVE-2026-3138 is classified as a critical vulnerability due to the risk of unauthorized data deletion.
What versions are affected by CVE-2026-3138?
CVE-2026-3138 affects all versions of Product Filter for WooCommerce by WBW up to and including 3.1.2.
How do I fix CVE-2026-3138?
To fix CVE-2026-3138, you need to update the Product Filter for WooCommerce plugin to the latest version available.
What type of attack does CVE-2026-3138 allow?
CVE-2026-3138 allows unauthenticated users to delete filter data, potentially resulting in data loss.
Is authentication required for exploiting CVE-2026-3138?
No, CVE-2026-3138 can be exploited without authentication, making it particularly dangerous.