CVE-2025-13314: 
WordPress vulnerability analysis and mitigation

CVE-2025-13314 is a missing authorization vulnerability in the "Product Filtering by Categories, Tags, Price Range for WooCommerce – Filter Plus" WordPress plugin that allows unauthenticated attackers to modify plugin settings and create arbitrary filter options. It affects all versions up to and including 1.1.6 (some sources cite 1.1.5 as the last vulnerable version). The vulnerability was published on December 12, 2025, and was assigned by Wordfence. It carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is a missing capability check (CWE-862) on two AJAX action handlers — filter_save_settings and add_filter_options — registered by the plugin. Because no authentication or privilege verification is performed before processing these AJAX requests, any unauthenticated network user can invoke them directly. Exploitation requires only the ability to send HTTP POST requests to the WordPress admin-ajax.php endpoint with the appropriate action parameter; no credentials, tokens, or user interaction are needed. Vulnerable code paths are visible in the plugin's source at core/admin/settings/action.php (lines 23, 28, 82) and base/enqueue.php (line 178) (Wordfence, Plugin Source L23).

Successful exploitation allows unauthenticated attackers to arbitrarily modify the plugin's configuration and inject malicious filter options into WooCommerce storefronts, compromising the integrity of the product filtering experience for end users. While confidentiality and availability are not directly impacted, a threat actor could manipulate product display logic, inject misleading filter categories, or degrade the shopping experience. In a broader attack chain, persistent configuration changes could serve as a foothold for further abuse if combined with other vulnerabilities (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the "Filter Plus" WooCommerce plugin (versions ≤ 1.1.6) using passive techniques such as checking readme.txt at /wp-content/plugins/filter-plus/readme.txt or using tools like WPScan.
2. Craft AJAX request: Prepare an HTTP POST request targeting the WordPress AJAX endpoint: POST /wp-admin/admin-ajax.php.
3. Invoke vulnerable action — modify settings: Set the action parameter to filter_save_settings and include desired plugin configuration values in the POST body. No authentication cookie or nonce is required.
4. Invoke vulnerable action — inject filter options: Set the action parameter to add_filter_options and supply arbitrary filter option data to inject malicious or misleading product filter entries into the storefront.
5. Verify impact: Browse the WooCommerce storefront to confirm that the injected filter options appear and that plugin settings have been altered as intended (Wordfence, Plugin Source L23).

• Network: Unexpected POST requests to /wp-admin/admin-ajax.php with action=filter_save_settings or action=add_filter_options originating from unauthenticated (non-logged-in) sources or unfamiliar IP addresses.
• Logs: WordPress or web server access logs showing repeated unauthenticated AJAX calls to the above actions, particularly from automated or scripted sources (high request frequency, no session cookies).
• Database: Unexpected or unauthorized changes to plugin option rows in the wp_options table associated with the Filter Plus plugin (e.g., option names prefixed with filter_plus_).
• Application: Unexplained appearance of new or modified product filter categories/tags on the WooCommerce storefront not created by an administrator.

Users should update the Filter Plus plugin to a version beyond 1.1.6 that includes proper capability checks on the affected AJAX actions. Until a patched version is available or confirmed, site administrators should consider deactivating the plugin to eliminate the attack surface. Additionally, a web application firewall (WAF) rule blocking unauthenticated POST requests to admin-ajax.php with the filter_save_settings or add_filter_options action parameters can serve as a temporary mitigation (Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the advisory on December 12, 2025. No significant broader media coverage, notable researcher commentary, or social media discussion has been identified for this CVE beyond the initial Wordfence disclosure and standard vulnerability feed aggregation (Wordfence).