{"id":"CVE-2026-11396","kind":"vulnerability","aliases":["CVE-2026-11396"],"related":[],"title":"WooCommerce Product Filter plugin: unauthenticated users can list unpublished products","description":"The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Missing Authorization / Information Disclosure in all versions up to, and including, 3.4.6 via the 'filterSettings[default_query]' parameter of the 'filtersFrontend' AJAX action. The handler is registered as 'wp_ajax_nopriv_filtersFrontend' and performs no capability or nonce check; raw POST data is JSON-decoded into $filterSettings and the attacker-controlled 'default_query' array is unconditionally array_merge()'d into the WP_Query arguments, overriding the plugin's safe defaults (most notably post_status, post_type, posts_per_page, and nopaging). This makes it possible for unauthenticated attackers to enumerate non-public WooCommerce products (draft, future, pending) — including their count and rendered listing markup — and to force unbounded queries that load all products in a single request.","summary":"The Product Filter for WooCommerce plugin through version 3.4.6 has an AJAX handler that accepts attacker-controlled query arguments without any authorization check. An unauthenticated visitor can use it to list draft, future and pending WooCommerce products and to force queries that load every product at once.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","product-filter-for-woocommerce","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Product Filter for WooCommerce by WBW plugin in the WordPress admin plugin list; versions up to and including `3.4.6` are described as affected.\n- Look for the `filtersFrontend` AJAX action registered with `wp_ajax_nopriv_` in the plugin's code.","fix":"- Product Filter for WooCommerce by WBW: unknown; the sources do not name a fixed version.","status":"open","published_at":"2026-10-31T07:16:37+00:00","first_seen_at":"2026-10-31T07:34:07+00:00","triaged_at":"2026-10-31T07:34:47+00:00","updated_at":"2026-10-31T07:34:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T07:34:47Z","model":"claude-haiku-5-5","output":{"fix":"- Product Filter for WooCommerce by WBW: unknown; the sources do not name a fixed version.","reach":"internet","title":"WooCommerce Product Filter plugin: unauthenticated users can list unpublished products","impact":"low","summary":"The Product Filter for WooCommerce plugin through version 3.4.6 has an AJAX handler that accepts attacker-controlled query arguments without any authorization check. An unauthenticated visitor can use it to list draft, future and pending WooCommerce products and to force queries that load every product at once.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","product-filter-for-woocommerce"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated visitors read unpublished product data and counts","analyst_note":"Confirm the fixed version and whether the vendor has released a patch; the sources give none.","how_to_check":"- Check the installed version of the Product Filter for WooCommerce by WBW plugin in the WordPress admin plugin list; versions up to and including `3.4.6` are described as affected.\n- Look for the `filtersFrontend` AJAX action registered with `wp_ajax_nopriv_` in the plugin's code.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Product Filter for WooCommerce by WBW plugin version 3.4.6 or earlier on WordPress with WooCommerce. The exposure is the unauthenticated AJAX endpoint, so any public storefront with the plugin active is reachable; sites without the plugin can skip it. The sources do not say whether non-default configuration is required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000756,"input_tokens":4341,"output_tokens":644,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-11396':13A,16A '-2026':12A,15A '3.4.6':33B,95C 'accept':39B 'action':106C 'ajax':36B,105C,113C 'argument':44B,149C 'array':139C,142C 'attack':41B,135C,173C 'attacker-control':40B,134C 'author':47B,85C 'capabl':119C 'check':48B,122C 'control':42B,136C 'count':186C 'cve':11A,14A 'd':144C 'data':125C 'decod':129C 'default':99C,137C,155C 'disclosur':87C 'draft':57B,181C 'enumer':175C 'everi':69B 'filter':3A,20B,27B,73C 'filterset':98C,131C 'filtersfrontend':104C,115C 'forc':65B,193C 'futur':58B,182C 'handler':37B,108C 'includ':94C,184C 'inform':86C 'json':128C 'json-decod':127C 'list':8A,56B,189C 'load':68B,197C 'make':168C 'markup':190C 'merg':143C 'miss':84C 'non':177C 'non-publ':176C 'nonc':121C 'nopag':166C 'nopriv':114C 'notabl':157C 'overrid':150C 'packag':17B 'page':164C 'paramet':101C 'pend':60B,183C 'per':163C 'perform':117C 'plugin':4A,30B,78C,152C 'possibl':170C 'post':124C,158C,160C,162C 'product':2A,10A,19B,26B,62B,70B,72C,180C,199C 'product-filter-for-woocommerc':18B 'public':178C 'queri':43B,66B,100C,138C,148C,195C 'raw':123C 'regist':110C 'render':188C 'request':203C 'safe':154C 'singl':202C 'status':159C 'type':161C 'unauthent':5A,50B,172C 'unbound':194C 'uncondit':141C 'unpublish':9A 'use':53B 'user':6A 'version':32B,90C 'via':96C 'visitor':51B 'vulner':82C 'wbw':77C 'without':45B 'woocommerc':1A,22B,23B,29B,61B,75C,179C 'wordpress':24B,80C 'wp':112C,147C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Product Filter for WooCommerce by WBW plugin version 3.4.6 or earlier on WordPress with WooCommerce. The exposure is the unauthenticated AJAX endpoint, so any public storefront with the plugin active is reachable; sites without the plugin can skip it. The sources do not say whether non-default configuration is required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T07:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-11396","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11396","severity":null,"published_at":"2026-10-31T07:16:37+00:00","modified_at":"2026-10-31T07:16:37+00:00","first_seen_at":"2026-10-31T07:34:07+00:00","fetched_at":"2026-10-31T07:34:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}