CVE-2025-11269: WordPress Product Filter Auth Bypass Flaw

CVE-2025-11269 Overview

CVE-2025-11269 is a missing authorization vulnerability in the Product Filter by WBW plugin for WordPress. The flaw affects all versions up to and including 3.0.0. The plugin fails to perform a capability check on the approveNotice action, allowing unauthenticated attackers to modify the plugin's settings over the network. The issue is tracked under CWE-862: Missing Authorization and was fixed in version 3.0.1, released on 21/10/2025.

Critical Impact
Unauthenticated attackers can update the Product Filter by WBW plugin settings on any affected WordPress site, altering site behavior without any credentials or user interaction.

Affected Products

Product Filter by WBW plugin for WordPress — all versions up to and including 3.0.0
WooCommerce stores using the Product Filter by WBW (woo-product-filter) plugin
Fixed in Product Filter by WBW version 3.0.1

Discovery Timeline

2025-10-25 - CVE-2025-11269 published to NVD
21/10/2025 - Vendor releases 3.0.1 with fix for "Missing Authorization to Unauthenticated Settings Update"
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11269

Vulnerability Analysis

The Product Filter by WBW plugin exposes an approveNotice action handler that is reachable without authentication. The handler updates plugin settings but does not verify the caller's capability. As a result, any unauthenticated visitor can invoke the endpoint and change stored configuration values. The issue is classified as a broken access control weakness [CWE-862] with a network-based attack vector and low impact to integrity. The current EPSS score is 0.264% at the 17.8 percentile, indicating limited observed exploitation activity to date.

Root Cause

The root cause is the absence of a WordPress capability check (for example, current_user_can()) and a nonce validation on the approveNotice action inside the plugin's overview controller. Because WordPress AJAX and admin-post endpoints are publicly reachable by design, any action that mutates state must gate execution behind capability and nonce checks. The vulnerable code path performed neither, treating the request as trusted.

Attack Vector

An attacker sends a crafted HTTP request to the WordPress AJAX endpoint targeting the plugin's approveNotice action. No authentication, no user interaction, and no prior access are required. Successful requests persist attacker-controlled settings changes for the plugin.

php

// Patch context in modules/overview/controller.php (v3.0.1)
// Source: https://github.com/wpcodefactory/woo-product-filter/commit/313f69908cadc31fa9c1e098ff989dc4f75dfdb5
<?php
/**
 * Product Filter by WBW - OverviewControllerWpf Class
 *
 * @version 3.0.1
 *
 * @author  woobewoo
 */

defined( 'ABSPATH' ) || exit;

class OverviewControllerWpf extends ControllerWpf {

    /**
     * subscribe.
     */
    public function subscribe() {
        $res = new ResponseWpf();
        if ($this->getModel()->subscribe(ReqWpf::get('post'))) {
            // ...
        }
    }
}

The 3.0.1 changelog entry confirms the fix: Fix - Security - "Missing Authorization to Unauthenticated Settings Update" vulnerability fixed. (Source: GitHub commit 313f699).

Detection Methods for CVE-2025-11269

Indicators of Compromise

Unauthenticated POST requests to wp-admin/admin-ajax.php referencing the approveNotice action or the woo-product-filter module.
Unexpected modifications to Product Filter by WBW plugin settings stored in wp_options without a corresponding administrator login session.
Repeated requests from a single IP address exercising woo-product-filter endpoints without a valid _wpnonce parameter.

Detection Strategies

Inspect web server access logs for requests to admin-ajax.php containing action=approveNotice originating from unauthenticated sessions.
Compare current plugin settings against a known-good baseline and alert on drift when no admin activity is recorded.
Correlate WordPress audit logs (via a security plugin) with the plugin version to identify sites still running 3.0.0 or earlier.

Monitoring Recommendations

Enable request logging on WordPress AJAX and admin-post endpoints and forward events to a central log platform.
Monitor for changes to wp_options rows associated with the woo-product-filter prefix.
Track outbound requests from the WordPress host that could indicate abuse of altered plugin behavior.

How to Mitigate CVE-2025-11269

Immediate Actions Required

Upgrade the Product Filter by WBW plugin to version 3.0.1 or later on all WordPress sites.
Audit wp_options values used by the plugin and restore any settings that appear altered.
Rotate WordPress administrator credentials and API keys if unauthorized configuration changes are confirmed.

Patch Information

The vendor fixed the issue in version 3.0.1, released 21/10/2025. The fix is implemented in commit 313f69908cadc31fa9c1e098ff989dc4f75dfdb5 and mirrored in the WordPress plugin changeset. Additional details are available in the Wordfence Vulnerability Report.

Workarounds

If patching is delayed, deactivate the Product Filter by WBW plugin until version 3.0.1 can be deployed.
Restrict access to wp-admin/admin-ajax.php at the web application firewall (WAF) layer to block requests targeting the approveNotice action from unauthenticated clients.
Enforce IP allow-listing for administrative endpoints where operationally feasible.

bash

# Example WP-CLI commands to verify and update the plugin
wp plugin get woo-product-filter --field=version
wp plugin update woo-product-filter --version=3.0.1
wp plugin list | grep woo-product-filter