CVE-2026-3138: WooCommerce Filter Auth Bypass Vulnerability

CVE-2026-3138 Overview

The Product Filter for WooCommerce by WBW plugin for WordPress contains a critical missing authorization vulnerability (CWE-862) that enables unauthenticated attackers to permanently delete all filter configurations from the database. This vulnerability affects all versions up to and including 3.1.2, allowing unauthorized data loss through crafted AJAX requests.

The flaw exists within the plugin's MVC framework architecture, which dynamically registers AJAX handlers via wp_ajax_nopriv_ hooks without implementing proper capability checks. Combined with permissive default behavior in the permission checking system, this creates an exploitable pathway for unauthenticated users to truncate the wp_wpf_filters database table.

Critical Impact

Unauthenticated attackers can permanently destroy all WooCommerce product filter configurations through a single crafted AJAX request, causing significant operational disruption for e-commerce sites relying on this filtering functionality.

Affected Products

• Product Filter for WooCommerce by WBW plugin versions ≤ 3.1.2
• WordPress sites using vulnerable versions of the woo-product-filter plugin
• WooCommerce stores with filter configurations stored in wp_wpf_filters table

Discovery Timeline

• 2026-03-24 - CVE CVE-2026-3138 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-3138

Vulnerability Analysis

This authorization bypass vulnerability stems from multiple architectural weaknesses in the plugin's MVC framework that compound to create an exploitable condition. The core issue is the absence of capability verification when processing AJAX requests from unauthenticated users.

The vulnerability chain involves three interconnected components: the frame class's AJAX handler registration, the base controller's magic method forwarding, and the default-permissive authorization model. When the plugin initializes, it registers AJAX action handlers using WordPress's wp_ajax_nopriv_ hook prefix, which allows non-logged-in users to trigger these actions. The base controller implements a __call() magic method that forwards undefined method invocations directly to the model layer without intermediate authorization checks.

Most critically, the havePermissions() method returns true by default when no explicit permissions are defined for an action, creating a fail-open authorization model rather than fail-closed. An attacker can exploit this by sending a crafted AJAX request with action=delete to truncate the wp_wpf_filters table, permanently destroying all saved filter configurations.

Root Cause

The root cause is the missing capability check (CWE-862) in the AJAX handler registration combined with a permissive default authorization model. The havePermissions() method defaults to returning true when no explicit permissions are configured, and the __call() magic method in the controller forwards requests to the model layer without validating user capabilities. This architectural design flaw allows unauthenticated requests to execute privileged database operations.

Attack Vector

The attack leverages the network-accessible AJAX endpoint that processes unauthenticated requests. An attacker requires no prior authentication or special privileges to exploit this vulnerability. The attack can be executed remotely by sending a specially crafted HTTP POST request to the WordPress AJAX handler endpoint (/wp-admin/admin-ajax.php) with the appropriate action parameter set to trigger the delete operation.

The exploitation path follows this sequence: the attacker sends an AJAX request → the wp_ajax_nopriv_ hook catches the request → the controller's __call() method forwards it to the model → the havePermissions() check passes by default → the model executes the table truncation.

For detailed technical analysis of the vulnerable code paths, see the WordPress Plugin Code References and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-3138

Indicators of Compromise

• Unexpected AJAX POST requests to /wp-admin/admin-ajax.php with action=delete parameter from unauthenticated sessions
• Sudden loss of all Product Filter configurations without administrator action
• Empty wp_wpf_filters database table on sites with previously configured filters
• Unusual spikes in unauthenticated POST requests to WordPress AJAX endpoints

Detection Strategies

• Monitor web server access logs for POST requests to admin-ajax.php containing suspicious action parameters from non-authenticated users
• Implement database monitoring to detect TRUNCATE or DELETE operations on wp_wpf_filters table
• Deploy Web Application Firewall (WAF) rules to inspect and block malicious AJAX requests targeting WooCommerce plugin endpoints
• Configure WordPress security plugins to alert on unusual patterns of unauthenticated AJAX activity

Monitoring Recommendations

• Enable detailed logging for WordPress AJAX handlers and review logs for anomalous unauthenticated requests
• Set up automated alerts for database schema changes or bulk deletions affecting WooCommerce-related tables
• Implement baseline monitoring for the wp_wpf_filters table row count to detect unexpected data loss
• Regularly audit WordPress plugins for missing authorization checks using static analysis tools

How to Mitigate CVE-2026-3138

Immediate Actions Required

• Update Product Filter for WooCommerce by WBW to the latest patched version immediately
• Backup all existing filter configurations from the wp_wpf_filters table before applying updates
• Review access logs for evidence of exploitation attempts targeting AJAX endpoints
• Consider temporarily disabling the plugin if immediate update is not possible

Patch Information

The vendor has released a security update addressing this vulnerability. Users should update to a version newer than 3.1.2. The patch introduces proper capability checks before processing AJAX delete requests, ensuring only authorized administrators can modify filter configurations.

For patch details, see the WordPress Plugin Changeset. The plugin is available on the WordPress Plugin Directory.

Workarounds

• Implement a Web Application Firewall rule to block unauthenticated AJAX requests with action=delete parameters targeting the plugin
• Add a custom WordPress filter or plugin to enforce capability checks on wp_ajax_nopriv_ actions used by the Product Filter plugin
• Restrict access to admin-ajax.php for unauthenticated users at the web server level if the plugin's front-end filtering functionality is not required
• Create regular automated backups of the wp_wpf_filters table to enable rapid recovery if exploitation occurs

# Block unauthenticated AJAX delete requests via .htaccess (Apache)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_METHOD} POST
    RewriteCond %{REQUEST_URI} admin-ajax\.php$
    RewriteCond %{QUERY_STRING} action=delete [NC,OR]
    RewriteCond %{HTTP:X-Requested-With} !XMLHttpRequest
    RewriteRule .* - [F,L]
</IfModule>