Missing Authorization Vulnerability in Product Filter for WooCommerce by WBW

CVE-2026-11396

What is CVE-2026-11396?

The Product Filter for WooCommerce by WBW plugin is susceptible to missing authorization and information disclosure vulnerabilities. This issue allows unauthenticated attackers to exploit the 'filterSettings[default_query]' parameter of the 'filtersFrontend' AJAX action. The function fails to implement necessary capability or nonce checks, leading to the exposure of non-public WooCommerce products, such as drafts and pending items. By manipulating the input, attackers can potentially enumerate these products along with their details, enabling them to perform unbounded queries that could retrieve extensive product listings in a single request.

References