BaseFortify

Publication date: 2025-10-25

Last updated on: 2025-10-27

Assigner: Wordfence

Description

The Product Filter by WBW plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'approveNotice' action in all versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to update the plugin's settings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-25

Last Modified

2025-10-27

Generated

2026-07-06

AI Q&A

2025-10-25

EPSS Evaluated

2026-07-05

NVD

CVE-2025-11269

Affected Vendors & Products

Vendor	Product	Version / Range
wbw	product_filter	3.0.0
wordpress	wordpress	*
wbw	product_filter	3.0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Product Filter by WBW plugin for WordPress, where a missing capability check on the 'approveNotice' action allows unauthenticated attackers to modify the plugin's settings without authorization in all versions up to and including 3.0.0.

Impact Analysis

The vulnerability allows unauthenticated attackers to update the plugin's settings, which could lead to unauthorized changes in the website's behavior or configuration, potentially compromising the integrity of the site.

Hi! I’m here to help you understand CVE-2025-11269. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70