CVE-2026-16611
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before version 13.5.7 does not perform an authorization check on one of its REST read routes. This allows unauthenticated users to disclose a store's feed configuration (rules, filters, field mapping) and to enumerate the full product category taxonomy.
Risk Assessment
Risk of exposing sensitive store configuration and category structure, which could be used for further attacks or data theft.
Recommendation
Update the Product Feed PRO plugin to version 13.5.7 or later and restrict access to REST endpoints using a firewall or security plugins.
Original NVD description (English source)
The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowing unauthenticated users to disclose a store's feed configuration (rules, filters and field mapping) and to enumerate the full product category taxonomy.