CVE-2026-9331 in EDD Product Catalog Feed Plugin
Summary
by MITRE • 09/08/2026
The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcf_delete_feed function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in the EDD Product Catalog Feed by PixelYourSite plugin for WordPress represents a critical failure in access control mechanisms, specifically within the wpeddpcf_delete_feed function across all versions up to 1.0.2. This flaw is classified under CWE-862, which denotes Missing Authorization, as the application fails to verify whether the authenticated user possesses the necessary privileges to execute data modification operations. The core technical issue stems from the absence of a capability check that ensures only administrators or users with specific elevated permissions can trigger feed deletion actions. Consequently, any user account with subscriber-level access and above, which is often granted by default in standard WordPress installations for basic site interaction, retains the ability to invoke this sensitive function without restriction.
From an operational perspective, the exploitation of this vulnerability allows attackers to delete arbitrary option values stored within the WordPress database options table. While the immediate action appears to be data deletion, the strategic impact involves manipulating configuration settings that are critical for the proper functioning of the site or its integrated plugins. By targeting specific option keys associated with the EDD Product Catalog Feed functionality, an attacker can corrupt the state of the application in a way that triggers fatal errors during subsequent page loads or feed generation processes. This corruption effectively breaks the intended workflow, leading to a denial of service for legitimate users who attempt to access product information or interact with the e-commerce features provided by the plugin.
The attack vector is particularly concerning because it requires only authenticated access rather than complex exploitation techniques such as SQL injection or cross-site scripting. Since subscriber-level accounts are commonly created for customers, contributors, and other low-privilege roles in WordPress environments, the barrier to entry for an attacker is significantly lowered if any of these accounts have been compromised through weak credentials, phishing, or session hijacking. This aligns with ATT&CK technique T1078, Valid Accounts, where adversaries leverage legitimate user credentials to maintain persistence and perform malicious actions within the system. The ability to delete configuration options transforms a simple authentication bypass into a potent tool for disrupting business operations and degrading service availability.
Mitigation strategies must focus on both immediate remediation and long-term security hardening. The primary recommendation is to upgrade the EDD Product Catalog Feed by PixelYourSite plugin to version 1.0.3 or later, where this missing capability check has been addressed by the developers. In instances where upgrading is not immediately feasible, administrators should implement strict role-based access control policies to ensure that only users with administrator-level privileges can manage feed configurations and settings. Additionally, deploying a Web Application Firewall can help detect and block anomalous requests targeting sensitive administrative endpoints, although this serves as a compensating control rather than a fix for the underlying code flaw. Regular security audits of custom plugins are also advised to identify similar authorization gaps before they can be exploited in production environments.