The Product Filter for WooCommerce by WBW plugin for WordPress contains a missing capability check that allows attackers to send unauthenticated AJAX requests using the wp_ajax_nopriv_ hook. The plugin’s controller forwards undefined method calls to the model through a magic __call() method, and default permission checks always return true when no explicit permissions are set. This combination lets an attacker issue a crafted request that executes a TRUNCATE TABLE command on the plugin’s wp_wpf_filters database table, permanently deleting all filter configurations and causing irreversible data loss.

WordPress sites running the Product Filter for WooCommerce by WBW plugin in any version up to and including 3.1.2 are affected. The vulnerability does not involve other plugins or core WordPress components. Any site using these versions of the plugin is at risk.

The CVSS score of 6.5 indicates a moderate severity vulnerability. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated web request—an attacker can simply send the malicious AJAX call to the vulnerable plugin’s endpoint without needing credentials or any prior compromise.