CVE-2026-118089
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
The WordPress plugin Product Feed Manager in versions up to 7.14.1 contains a PHP Object Injection vulnerability exploitable by a shop manager-level user. This may lead to injection of a malicious PHP object.
Risk Assessment
This may allow a shop manager to perform unauthorized actions or escalate privileges depending on available gadgets. The risk affects sites with the vulnerable plugin version.
Recommendation
Update the Product Feed Manager plugin to the latest version (above 7.14.1). Review shop manager account permissions until updated.
Other vulnerabilities in Product Feed Manager
See all- CVE-2026-118093Medium
The Product Feed Manager plugin by WPFunnels Team (up to version 7.14.1) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-66580High
The WordPress plugin Product Feed Manager in versions up to 7.12.0 contains an SQL Injection vulnerability accessible to users with Contributor privileges. A Contributor can inject malicious SQL queries through a vulnerable parameter.
- CVE-2026-59553High
Unauthenticated Cross-Site Scripting (XSS) vulnerability in the Product Feed Manager plugin up to version 7.6.1. Allows an attacker to inject malicious scripts.
Original NVD description (English source)
Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS