Input validation vulnerability in Themify – WooCommerce Product Filter 1.4.3

The Themify – WooCommerce Product Filter plugin for WordPress has a security issue called Cross-Site Request Forgery. This can happen in all versions, including 1.4.3. The problem is that there is no proper check for a code called “nonce” on the wpf_search page. This means that someone who doesn’t have permission to access the site can trick the site administrator into accidentally deleting important filters by making them click on a fake link.