The Filter Plus plugin for WooCommerce is missing a capability check on the AJAX actions that save settings and add filter options. This flaw allows any unauthenticated user to modify the plugin’s configuration, creating arbitrary filter options that can affect the presentation and ordering of products for all site visitors. Because the vulnerability does not alter core WordPress files or data stores outside the plugin, the impact is limited to the plugin’s functionality but can still disrupt business processes relying on precise product filtering.

Any WordPress installation running Filter Plus version 1.1.6 or older is affected. The vulnerability covers all releases up to the 1.1.6 tag, including the 1.1.5 and earlier releases referenced in the plugin’s core and admin files. The affected component is the plugin’s AJAX endpoint handling the "filter_save_settings" and "add_filter_options" actions.

The CVSS score of 5.3 indicates a medium severity, and the EPSS score of less than 1% shows that exploitation is currently considered unlikely. The flaw is not listed in CISA’s KEV catalog, but it remains exploitable if the plugin is enabled and accessible from the internet. Attackers can trigger the flaw by sending crafted HTTP POST requests to the plugin’s AJAX endpoints – the likely attack vector is inferred from the presence of the "filter_save_settings" and "add_filter_options" actions mentioned in the source code.