Live › vulnerability › CVE-2026-11396
The Product Filter for WooCommerce plugin through version 3.4.6 has an AJAX handler that accepts attacker-controlled query arguments without any authorization check. An unauthenticated visitor can use it to list draft, future and pending WooCommerce products and to force queries that load every product at once.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 07:34 UTC. All times on this page are UTC.
Sites running the Product Filter for WooCommerce by WBW plugin version 3.4.6 or earlier on WordPress with WooCommerce. The exposure is the unauthenticated AJAX endpoint, so any public storefront with the plugin active is reachable; sites without the plugin can skip it. The sources do not say whether non-default configuration is required.
No product ranges from the sources yet.
3.4.6 are described as affected.filtersFrontend AJAX action registered with wp_ajax_nopriv_ in the plugin's code.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Missing Authorization / Information Disclosure in all versions up to, and including, 3.4.6 via the 'filterSettings[default_query]' parameter of the 'filtersFrontend' AJAX action. The handler is registered as 'wp_ajax_nopriv_filtersFrontend' and performs no capability or nonce check; raw POST data is JSON-decoded into $filterSettings and the attacker-controlled 'default_query' array is unconditionally array_merge()'d into the WP_Query arguments, overriding the plugin's safe defaults (most notably post_status, post_type, posts_per_page, and nopaging). This makes it possible for unauthenticated attackers to enumerate non-public WooCommerce products (draft, future, pending) — including their count and rendered listing markup — and to force unbounded queries that load all products in a single request.
This page as .md · .json · in your agent: get_signal("CVE-2026-11396")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.