The Product Filter by WBW plugin for WooCommerce contains a missing authorization (CWE-862) vulnerability due to the lack of a capability check on the 'approveNotice' action. This flaw enables unauthenticated attackers to update the plugin's settings without proper permissions. The issue affects all versions up to 3.0.0. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but low impact on integrity.

An attacker can modify the plugin's settings without authentication, potentially altering how the product filter behaves on the WooCommerce site. This does not affect data confidentiality or availability but compromises the integrity of the plugin configuration. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the WordPress admin interface and monitor for unauthorized changes to plugin settings. Avoid exposing the plugin's administrative endpoints publicly.