---
id: "CVE-2026-11396"
kind: "vulnerability"
aliases: ["CVE-2026-11396"]
title: "WooCommerce Product Filter plugin: unauthenticated users can list unpublished products"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "product-filter-for-woocommerce", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-31T07:16:37+00:00"
first_seen_at: "2026-10-31T07:34:07+00:00"
updated_at: "2026-10-31T07:34:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11396", "first_seen_at": "2026-10-31T07:34:07+00:00"}]
---

# WooCommerce Product Filter plugin: unauthenticated users can list unpublished products

The Product Filter for WooCommerce plugin through version 3.4.6 has an AJAX handler that accepts attacker-controlled query arguments without any authorization check. An unauthenticated visitor can use it to list draft, future and pending WooCommerce products and to force queries that load every product at once.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Product Filter for WooCommerce by WBW plugin in the WordPress admin plugin list; versions up to and including `3.4.6` are described as affected.
- Look for the `filtersFrontend` AJAX action registered with `wp_ajax_nopriv_` in the plugin's code.

## Fix

- Product Filter for WooCommerce by WBW: unknown; the sources do not name a fixed version.

## Timeline

- 2026-10-31T07:34:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-11396

## From the sources

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Missing Authorization / Information Disclosure in all versions up to, and including, 3.4.6 via the 'filterSettings[default_query]' parameter of the 'filtersFrontend' AJAX action. The handler is registered as 'wp_ajax_nopriv_filtersFrontend' and performs no capability or nonce check; raw POST data is JSON-decoded into $filterSettings and the attacker-controlled 'default_query' array is unconditionally array_merge()'d into the WP_Query arguments, overriding the plugin's safe defaults (most notably post_status, post_type, posts_per_page, and nopaging). This makes it possible for unauthenticated attackers to enumerate non-public WooCommerce products (draft, future, pending) — including their count and rendered listing markup — and to force unbounded queries that load all products in a single request.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_