High severity · published Oct 16, 2024
CVE-2021-4444
Product Filter by WooBeWoo <= 1.4.9 - Missing Authorization
7.3
CVSS
0.3%
EPSS
No
On KEV
Description
The Product Filter by WooBeWoo plugin for WordPress is vulnerable to authorization bypass in versions up to, and including 1.4.9 due to missing authorization checks on various functions. This makes it possible for unauthenticated attackers to perform unauthorized actions such as creating new filters and injecting malicious javascript into a vulnerable site. This was actively exploited at the time of discovery.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PF
Product Filter for WooCommerce by WBW · woobewoo
through 1.4.9 · source: vendor
PF
Product Filter · Woobewoo
through 1.4.9 · source: CISA
Affected product
PF
Product Filter for WooCommerce by WBW
woobewoo
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-4444
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-4444
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2527958%40woo-product-filter&new=2527958%40woo-product-filter&sfp_email=&sfph_mail=
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/30b6b0bf-e632-4e83-89ee-a424382534da?source=cve
More from Product Filter for WooCommerce by WBW
7.5
CVE-2025-8416
Product Filter by WBW <= 2.9.7 - Unauthenticated SQL Injection
7.5
CVE-2025-2317
Product Filter by WBW <= 2.7.9 - Unauthenticated SQL Injection via filtersDataBackend Parameter
6.5
CVE-2026-3138
Product Filter for WooCommerce by WBW <= 3.1.2 - Missing Authorization to Unauthenticated Filter Data Deletion via TRUNCATE TABLE
6.1
CVE-2026-7804
Product Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' Parameter
5.3
CVE-2025-11269
Product Filter by WBW <= 3.0.0 - Missing Authorization to Unauthenticated Settings Update