CVE-2026-3138: 
WordPress vulnerability analysis and mitigation

CVE-2026-3138 is a Missing Authorization vulnerability in the Product Filter for WooCommerce by WBW plugin for WordPress, allowing unauthenticated attackers to permanently truncate the plugin's filter configuration database table. It affects all versions up to and including 3.1.2. The vulnerability was published on March 24, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 6.5 (Medium) (Wordfence, ENISA EUVD).

The root cause is classified as CWE-862 (Missing Authorization). The plugin's MVC framework dynamically registers unauthenticated AJAX handlers via WordPress wp_ajax_nopriv_ hooks without verifying user capabilities. The base controller's __call() magic method forwards undefined method calls directly to the model layer, and the havePermissions() method defaults to true when no explicit permissions are defined. This chain allows any unauthenticated attacker to send a crafted AJAX request with action=delete to invoke the delete handler, which truncates the wp_wpf_filters database table and permanently destroys all filter configurations (Wordfence, ENISA EUVD).

Successful exploitation results in permanent, irreversible destruction of all WooCommerce product filter configurations stored in the wp_wpf_filters database table. There is no confidentiality impact, but integrity and availability are both affected — store operators lose all custom filter setups, potentially disrupting the shopping experience and requiring manual reconfiguration. The attack requires no authentication or user interaction and can be executed remotely at scale against any vulnerable WordPress site (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.039%, indicating a low (but non-zero) probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack is trivially simple to execute — requiring only a single unauthenticated HTTP POST request — which lowers the practical barrier for exploitation (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the "Product Filter for WooCommerce by WBW" plugin (version ≤ 3.1.2) using tools like WPScan, Shodan, or by checking /wp-content/plugins/woo-product-filter/ for plugin presence.
2. Craft the AJAX request: Prepare an HTTP POST request targeting the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the parameter action=delete. No authentication cookies or nonces are required due to the wp_ajax_nopriv_ registration.
3. Send the request: Submit the crafted POST request (e.g., curl -X POST https://target.com/wp-admin/admin-ajax.php -d 'action=delete'). The plugin's __call() magic method routes the call to the model layer, and havePermissions() returns true by default.
4. Database truncation: The model executes a TRUNCATE or DELETE operation on the wp_wpf_filters table, permanently destroying all filter configurations with no recovery path unless a database backup exists (Wordfence).

• Network: Unexpected HTTP POST requests to /wp-admin/admin-ajax.php with the body parameter action=delete originating from unauthenticated (no session cookie) or unknown IP addresses.
• Logs: WordPress access logs showing POST /wp-admin/admin-ajax.php with action=delete returning HTTP 200 from non-admin IPs; absence of a valid WordPress authentication cookie in the request headers.
• Database: The wp_wpf_filters table found empty or missing all rows following an unexplained event; database audit logs (if enabled) showing a TRUNCATE or bulk DELETE on wp_wpf_filters from the web application user.

Update the Product Filter for WooCommerce by WBW plugin to version 3.1.3 or later, which addresses the missing capability check (Wordfence, WordPress Plugin Repo). As an interim measure, site administrators can use a Web Application Firewall (WAF) rule to block unauthenticated POST requests to admin-ajax.php with action=delete. Ensure regular database backups are in place so filter configurations can be restored if exploitation occurs before patching.

Wordfence included this vulnerability in their weekly WordPress vulnerability report for the period of March 23–29, 2026, and Sucuri highlighted it in their March 2026 vulnerability patch roundup (Wordfence Blog, Sucuri Blog). No notable individual researcher commentary or significant social media discussion has been identified beyond standard aggregator coverage.