Is CVE-2022-45813 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-45813 being exploited in the wild.

How severe is CVE-2022-45813?

Medium severity, with a CVSS score of 5.4, published 11 June 2026.

Which products and versions are affected?

BeRocket Advanced AJAX Product Filters n/a through 1.6.3.3.

Is there a fix for CVE-2022-45813?

A patch was published on 2023-07-12: Patch released in version 1.6.3.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-45813 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2022-45813?

Check whether you run BeRocket Advanced AJAX Product Filters at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-45813: BeRocket Advanced AJAX Product Filters missing authorization

CVE-2022-45813 · Severity: medium · CVSS 5.4 · Published 2026-06-11

BeRocket Advanced AJAX Product Filters is a WordPress plugin used to add advanced search and filtering capabilities to e-commerce websites. A security flaw in the plugin's access control settings allows logged-in users with low-level permissions to perform actions they should not be authorized to do. This could lead to unauthorized changes to product filter settings or the exposure of internal configuration data.

Vendors: BeRocket.

Quick answers

Is CVE-2022-45813 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-45813 being exploited in the wild.
How severe is CVE-2022-45813?: Medium severity, with a CVSS score of 5.4, published 11 June 2026.
Which products and versions are affected?: BeRocket Advanced AJAX Product Filters n/a through 1.6.3.3.
Is there a fix for CVE-2022-45813?: A patch was published on 2023-07-12: Patch released in version 1.6.3.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-45813 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2022-45813?: Check whether you run BeRocket Advanced AJAX Product Filters at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization vulnerability (CWE-862) exists in the BeRocket Advanced AJAX Product Filters plugin for WordPress. The flaw stems from incorrectly configured access control security levels, which fail to properly validate user permissions before executing certain functions. An authenticated attacker with subscriber-level privileges can exploit this over the network to perform unauthorized actions or access restricted settings. The vulnerability is addressed in version 1.6.3.4.

Affected products

BeRocket Advanced AJAX Product Filters n/a through 1.6.3.3

Timeline

2022-12-01: disclosed: Reported by István Márton
2023-07-12: patched: Patch released in version 1.6.3.4
2026-06-11: advisory: NVD publication date

References

https://patchstack.com/database/wordpress/plugin/woocommerce-ajax-filters/vulnerability/wordpress-advanced-ajax-product-filters-plugin-1-6-3-3-broken-access-control-csrf?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.