CVE-2026-3499
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A CSRF vulnerability in the Product Feed PRO for WooCommerce plugin (versions 13.4.6 to 13.5.2.1) allows unauthenticated attackers to trigger feed migration, clear cache, rewrite URLs, toggle filter settings, and delete feed posts by tricking an administrator into clicking a link.
Risk Assessment
An attacker could disrupt the WooCommerce store by deleting or modifying product feed configuration.
Recommendation
Update the plugin to version 13.5.3 or later, which includes proper nonce validation.
Other vulnerabilities in Product Feed PRO for WooCommerce
Original NVD description (English source)
The Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 13.4.6 through 13.5.2.1. This is due to missing or incorrect nonce validation on the ajax_migrate_to_custom_post_type, ajax_adt_clear_custom_attributes_product_meta_keys, ajax_update_file_url_to_lower_case, ajax_use_legacy_filters_and_rules, and ajax_fix_duplicate_feed functions. This makes it possible for unauthenticated attackers to trigger feed migration, clear custom-attribute transient caches, rewrite feed file URLs to lowercase, toggle legacy filter and rule settings, and delete duplicated feed posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS