CVE-2026-19778 in WPMR Google Feed Manager Plugin
Summary
by MITRE • 09/09/2026
The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQL Injection via the 'feed' parameter in all versions up to, and including, 2.23.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in WPMR Google Feed Manager for WooCommerce, specifically affecting versions up through 2.23.7, represents a critical security flaw rooted in improper input validation and sanitization mechanisms within the plugin's core functionality. This software serves as an integration bridge between WordPress-based e-commerce sites using WooCommerce and Google Merchant Center, facilitating the synchronization of product feeds for advertising purposes. The specific weakness lies in how the application handles user-supplied data passed via the feed parameter during administrative operations. Because the developer failed to implement adequate escaping procedures or utilize prepared statements when constructing SQL queries, the database engine interprets maliciously crafted input as executable code rather than literal string data. This architectural oversight creates a direct pathway for attackers to manipulate backend database structures and retrieve unauthorized information.
From a technical perspective, this flaw is classified under CWE-89, which denotes Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The vulnerability manifests through time-based techniques, where the attacker injects payloads that cause deliberate delays in query execution if certain conditions are met. By observing these timing differences, an authenticated adversary can systematically extract data from the database without triggering obvious error messages that might alert security monitoring systems. This method allows for blind extraction of sensitive information such as user credentials, session tokens, product pricing details, and other proprietary business logic stored within the WordPress database. The lack of sufficient preparation on existing SQL queries means that even if basic input filtering is present, it can be bypassed using standard injection payloads designed to break out of string contexts or manipulate boolean conditions in time-based blind injections.
The operational impact of this vulnerability is severe due to the privilege level required for exploitation. While the attack vector requires authentication with administrator-level access or higher, this does not mitigate the risk significantly because WordPress administrators often possess broad control over site configurations and data. An attacker who compromises an admin account can leverage this SQL injection capability to exfiltrate sensitive customer data, including personally identifiable information (PII) protected under regulations like GDPR or CCPA. Furthermore, successful exploitation could lead to complete database compromise, allowing the insertion of backdoors, modification of product listings for fraudulent purposes, or defacement of the e-commerce platform. The ability to append additional SQL queries means that an attacker is not limited to reading data but can potentially alter or delete records, disrupting business operations and causing significant financial loss through reputational damage and regulatory penalties.
In alignment with industry threat modeling frameworks such as MITRE ATT&CK, this vulnerability facilitates the T1059 technique of Command and Scripting Interpreter abuse, specifically within the context of database interaction (T1213). The exploitation path aligns with data exfiltration tactics where attackers use structured query language to retrieve sensitive information from stored databases. To mitigate this risk, immediate action is required by updating the WPMR Google Feed Manager plugin to a version newer than 2.23.7, which includes patches for input sanitization and proper SQL parameter binding. Administrators should also enforce strict role-based access control policies to limit administrative privileges to only those users who absolutely require them. Additionally, implementing Web Application Firewalls with rulesets capable of detecting time-based blind injection patterns can provide an additional layer of defense against exploitation attempts while patching is being applied across the infrastructure.