CVE-2026-103349

HighCVSS 7.2

Published: 05/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

32th percentile - higher than 32% of all known CVEs

Summary

Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7.

Risk Assessment

An attacker can exploit deserialization to execute malicious code on the server, potentially leading to full system compromise or data theft.

Recommendation

Upgrade the plugin to the latest available version that includes a fix, and restrict access to the admin panel.

Other vulnerabilities in Product Feed PRO for WooCommerce

CVE-2026-3499High
A CSRF vulnerability in the Product Feed PRO for WooCommerce plugin (versions 13.4.6 to 13.5.2.1) allows unauthenticated attackers to trigger feed migration, clear cache, rewrite URLs, toggle filter settings, and delete feed posts by tricking an administrator into clicking a link.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS