CVE-2026-3138 is a missing authorization vulnerability (CWE-862) in the Product Filter for WooCommerce by WBW WordPress plugin. The plugin's MVC framework registers unauthenticated AJAX handlers via wp_ajax_nopriv_ hooks without capability checks. The base controller's __call() magic method forwards undefined method calls to the model layer, and the havePermissions() method defaults to true when no explicit permissions are set. This combination allows unauthenticated attackers to issue an AJAX request with action=delete that truncates the wp_wpf_filters database table, causing permanent deletion of all filter configurations. The vulnerability affects all versions up to and including 3.1.2.

An unauthenticated attacker can permanently delete all filter configurations stored in the plugin's wp_wpf_filters database table by exploiting the missing authorization check. This results in data loss impacting the availability and integrity of the filter configurations used by the WooCommerce store. There is no indication of confidentiality impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin's AJAX endpoints if possible, and monitor for suspicious AJAX requests with action=delete. Avoid using the affected plugin versions in production environments where possible.