CVE-2026-118093 in Product Feed Manager Plugin
Summary
by MITRE • 10/29/2026
Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerce-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed Manager: from n/a through 7.14.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The identified security flaw resides within the WPFunnels Team Product Feed Manager plugin for WordPress, specifically affecting versions ranging from non-existent initial releases up to version 7.14.1. This vulnerability is classified as a missing authorization issue, which fundamentally represents an insecure direct object reference or broken access control mechanism where the application fails to properly verify that the user initiating an action has sufficient privileges to perform it. In the context of web applications and content management systems like WordPress, such flaws allow attackers who have authenticated accounts with lower privilege levels, such as subscribers or contributors, to execute administrative functions intended only for users with elevated rights, typically administrators. The specific module impacted is the Product Feed Manager, a component designed to generate XML feeds for products sold via WooCommerce stores, which are then submitted to platforms like Google Shopping or Facebook Catalogs.
From a technical perspective, this vulnerability stems from insufficient server-side validation of user roles and capabilities before processing requests related to feed management operations. When an authenticated attacker sends a crafted HTTP request targeting the internal endpoints responsible for creating, modifying, deleting, or exporting product feeds, the application does not adequately check if the session associated with that request possesses administrative privileges. Consequently, any logged-in user can manipulate these critical configuration settings without authorization. This type of flaw is commonly categorized under CWE-269, which denotes Improper Privilege Control, and aligns closely with CWE-862 regarding Missing Authorization checks in access control logic. The absence of robust role-based access control enforcement at the API or endpoint level creates a direct pathway for privilege escalation within the application environment.
The operational impact of this vulnerability is significant due to the sensitive nature of e-commerce data managed by WooCommerce and its associated feed generation tools. An attacker exploiting this flaw can alter product feeds, potentially injecting malicious URLs into product links that redirect customers to phishing sites or malware distribution centers. This compromises customer trust and exposes end-users to security risks beyond the immediate scope of the website administration panel. Furthermore, unauthorized access allows attackers to delete existing product feeds, disrupting marketing campaigns and search engine optimization efforts for legitimate business owners. In more severe scenarios, if the feed manager interacts with external APIs using stored credentials or tokens, an attacker could exfiltrate sensitive integration keys or manipulate data sent to third-party advertising platforms, leading to financial loss through fraudulent ad spend or compromised account integrity on those external services.
This vulnerability maps directly to several techniques within the MITRE ATT&CK framework for enterprise security. Specifically, it aligns with T1078 Valid Accounts, as exploitation requires initial authentication but leverages improper access control rather than credential theft. It also relates to T1530 Data from Cloud Storage Objects if the feeds involve accessing or modifying data stored in cloud-based repositories linked via the plugin. Additionally, depending on how the feed is utilized, it may facilitate T1189 Drive-by Compromise if malicious links are injected into product descriptions displayed publicly. The lack of proper authorization checks effectively bypasses standard security boundaries established by the CMS role hierarchy, allowing lateral movement within the application logic and potentially serving as a foothold for further exploitation against connected services or backend infrastructure.
Mitigation strategies must prioritize immediate remediation through software updates. Administrators running affected versions should upgrade to the latest stable release of WPFunnels Team Product Feed Manager where this authorization check has been properly implemented by the developers. Until an update is available, temporary mitigations include restricting access to the WordPress admin area using IP whitelisting or two-factor authentication for all administrative accounts to reduce the attack surface. Additionally, implementing a Web Application Firewall can help detect and block anomalous requests that attempt to manipulate feed management endpoints without proper session validation. Regular security audits focusing on role-based access control implementations across all installed plugins are essential to prevent similar misconfigurations in other parts of the WordPress ecosystem.