# CVE-2026-11396: WooCommerce Product Filter by WBW missing authorization in AJAX handler

Source: https://junglewise.ai/threats/cve-2026-11396-the-product-filter-for-woocommerce-by-wbw-plugin-for-wordpress-is  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-31. Updated: 2026-10-31  
License: CC BY 4.0 with a link back

CVE-2026-11396 · Severity: medium · CVSS 5.3 · Published 2026-10-31

The Product Filter for WooCommerce plugin for WordPress lacks proper access controls on an AJAX endpoint that allows unauthenticated users to access private product information and bypass query restrictions. An attacker can enumerate draft, future, and pending products that should not be visible to the public, and force the server to load all products at once, potentially causing performance issues or exposing business-sensitive inventory data.

Technologies: [WBW Product Filter for WooCommerce](https://junglewise.ai/threats/technologies/product-filter-for-woocommerce). Vendors: [WBW](https://junglewise.ai/threats/vendors/wbw).

## Quick answers

**Is CVE-2026-11396 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11396 being exploited in the wild.

**How severe is CVE-2026-11396?** Medium severity, with a CVSS score of 5.3, published 31 October 2026.

**Which products and versions are affected?** WBW Product Filter for WooCommerce up to and including 3.4.6.

**Is there a fix for CVE-2026-11396?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11396 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11396?** Check whether you run WBW Product Filter for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The 'filtersFrontend' AJAX action is registered as 'wp_ajax_nopriv_filtersFrontend' with no capability or nonce checks. The endpoint JSON-decodes POST data and directly array_merge()s an attacker-controlled 'default_query' parameter into WP_Query arguments, overriding safe defaults for post_status, post_type, posts_per_page, and nopaging. An unauthenticated attacker can query non-public post statuses and bypass pagination limits to enumerate products and retrieve rendered listing markup.

## Affected products

- WBW Product Filter for WooCommerce up to and including 3.4.6

## Timeline

- 2026-10-31: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/woo-product-filter/trunk/modules/woofilters/controller.php](https://plugins.trac.wordpress.org/browser/woo-product-filter/trunk/modules/woofilters/controller.php)
- [https://plugins.trac.wordpress.org/changeset?reponame=&old=3757178%40woo-product-filter&new=3757178%40woo-product-filter](https://plugins.trac.wordpress.org/changeset?reponame=&old=3757178%40woo-product-filter&new=3757178%40woo-product-filter)

## Related threats

- [WBW Product Filter for WooCommerce reflected XSS in text_no_products](https://junglewise.ai/threats/cve-2026-105150-the-product-filter-for-woocommerce-by-wbw-plugin-for-wordpress)
- [WBW Product Filter for WooCommerce reflected XSS in wpf_fid parameter](https://junglewise.ai/threats/cve-2026-7804-wbw-product-filter-for-woocommerce-reflected-xss-in-wpf-fid)