CVE-2025-13314

MediumCVSS 5.3

Published: 12/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

19th percentile - higher than 19% of all known CVEs

Summary

The Product Filtering by Categories, Tags, Price Range for WooCommerce – Filter Plus plugin for WordPress is vulnerable to unauthorized modification of data in versions up to and including 1.1.6. Missing capability check on the 'filter_save_settings' and 'add_filter_options' AJAX actions allows unauthenticated attackers to modify plugin settings and create arbitrary filter options.

Risk Assessment

Risk of unauthorized changes to store configuration, potentially leading to manipulation of displayed products, prices, or other settings, affecting store integrity and customer trust.

Recommendation

Update the Filter Plus plugin to the latest version if available. Additionally, check for unauthorized changes in settings and consider restricting access to the admin panel.

Other vulnerabilities in Filter Plus

CVE-2026-39607Medium
The Filter Plus plugin for WordPress lacks authorization, allowing an attacker to exploit incorrectly configured access control security levels.

Original NVD description (English source)

The Product Filtering by Categories, Tags, Price Range for WooCommerce – Filter Plus plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.1.6 due to a missing capability check on the 'filter_save_settings' and 'add_filter_options' AJAX actions. This makes it possible for unauthenticated attackers to modify the plugin's settings and create arbitrary filter options.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS