CVE-2026-118093
MediumCVSS 5.3Summary
The Product Feed Manager plugin by WPFunnels Team (up to version 7.14.1) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Risk Assessment
An attacker could perform unauthorized operations, potentially leading to modification of plugin data or configuration.
Recommendation
Update the Product Feed Manager plugin to the latest version and review user permissions.
Other vulnerabilities in Product Feed Manager
See all- CVE-2026-66580High
The WordPress plugin Product Feed Manager in versions up to 7.12.0 contains an SQL Injection vulnerability accessible to users with Contributor privileges. A Contributor can inject malicious SQL queries through a vulnerable parameter.
- CVE-2026-118089High
The WordPress plugin Product Feed Manager in versions up to 7.14.1 contains a PHP Object Injection vulnerability exploitable by a shop manager-level user. This may lead to injection of a malicious PHP object.
- CVE-2026-59553High
Unauthenticated Cross-Site Scripting (XSS) vulnerability in the Product Feed Manager plugin up to version 7.6.1. Allows an attacker to inject malicious scripts.
Original NVD description (English source)
Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerce-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed Manager: from n/a through 7.14.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS