CVE-2025-11269
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Product Filter by WBW plugin for WordPress (all versions up to and including 3.0.0) is vulnerable to unauthorized data modification due to a missing capability check on the 'approveNotice' action. An unauthenticated attacker can update the plugin's settings.
Risk Assessment
An attacker can modify the plugin's configuration without authentication, potentially altering product filtering behavior or causing other unwanted effects on the site.
Recommendation
Update the Product Filter by WBW plugin to a version newer than 3.0.0 as soon as it becomes available. Until then, consider restricting access to the admin panel or disabling the plugin.
Other vulnerabilities in Product Filter by WBW
See all- CVE-2026-112866Critical
The WordPress plugin Product Filter by WBW (woo-product-filter) up to version 3.4.6 is vulnerable to blind SQL injection due to improper neutralization of special elements in SQL commands. An attacker could exploit this to manipulate database queries.
- CVE-2026-95601Critical
Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.
- CVE-2026-39494Critical
The SQL Injection vulnerability in the Product Filter by WBW allows for Blind SQL Injection attacks. This issue affects versions from n/a through 3.1.2.
Original NVD description (English source)
The Product Filter by WBW plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'approveNotice' action in all versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to update the plugin's settings.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS