CVE-2026-11396

The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Missing Authorization / Information Disclosure in all versions up to, and including, 3.4.6 via the 'filterSettings[default query]' parameter of the 'filtersFrontend' AJAX action. The handler is registered as 'wp ajax nopriv filtersFrontend' and performs no capability or nonce check; raw POST data is JSON-decoded into $filterSettings and the attacker-controlled 'default query' array is unconditionally array merge()'d into the WP Query arguments, overriding the plugin's safe defaults (most notably post status, post type, posts per page, and nopaging). This makes it possible for unauthenticated attackers to enumerate non-public WooCommerce products (draft, future, pending) — including their count and rendered listing markup — and to force unbounded queries that load all products in a single request.