CVE-2026-66580

The WordPress plugin Product Feed Manager in versions up to 7.12.0 contains an SQL Injection vulnerability accessible to users with Contributor privileges. A Contributor can inject malicious SQL queries through a vulnerable parameter.

This vulnerability is more severe than cases requiring administrator privileges, as a Contributor account has a lower access threshold and may be easier to obtain. It can lead to leakage or modification of data in the WordPress database.

Update the Product Feed Manager plugin to a version newer than 7.12.0. Verify Contributor account permissions and regularly audit their activity.