CVE-2025-30959
Lifecycle Timeline
2Description
Missing Authorization vulnerability in WPFactory Product XML Feed Manager for WooCommerce product-xml-feeds-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product XML Feed Manager for WooCommerce: from n/a through <= 2.9.2.
Analysis
Missing authorization controls in WPFactory's Product XML Feed Manager for WooCommerce through version 2.9.2 allow attackers to exploit incorrectly configured access control security levels, potentially exposing sensitive product feed data or enabling unauthorized administrative actions. The vulnerability affects all versions up to and including 2.9.2, with no publicly available exploit code identified at time of analysis, and an EPSS score of 0.07% indicating very low real-world exploitation probability despite the authorization defect.
Technical Context
The vulnerability stems from CWE-862 (Missing Authorization), a fundamental access control flaw where the WordPress plugin fails to properly validate user permissions before granting access to sensitive functionality or data. This is distinct from CWE-287 (authentication bypass) as the plugin likely authenticates users but then fails to check whether those users have the appropriate role or capability to perform actions or access resources. In WordPress plugin architecture, this typically occurs when developers use action hooks or AJAX endpoints without properly calling functions like current_user_can() to verify user capabilities against required roles (e.g., manage_options, manage_woocommerce). The Product XML Feed Manager for WooCommerce generates product feeds in XML format-sensitive business data including pricing, inventory, and supplier information-making improper access controls a material risk if accessible to unauthorized users.
Affected Products
WPFactory Product XML Feed Manager for WooCommerce versions up to and including 2.9.2 are affected. This is a WordPress plugin distributed via the WordPress.org plugin repository and installed on WooCommerce-powered e-commerce sites. The vulnerability exists in all versions from the earliest release through version 2.9.2. See Patchstack vulnerability database for full advisory details: https://patchstack.com/database/Wordpress/Plugin/product-xml-feeds-for-woocommerce/vulnerability/wordpress-product-xml-feed-manager-for-woocommerce-2-9-2-broken-access-control-vulnerability?_s_id=cve
Remediation
Update WPFactory Product XML Feed Manager for WooCommerce to a version newer than 2.9.2. Consult the official Patchstack advisory and the plugin's GitHub or WordPress.org repository for the specific patched version number and release date. In the interim, WordPress administrators should audit user roles and capabilities assigned to subscribers and customers, ensuring that product feed generation or export functionality is restricted to shop managers and administrators only. Review custom code or additional plugins that may integrate with the feed manager's hooks or AJAX endpoints to ensure they enforce capability checks. If the plugin's feed endpoints are exposed via public URLs, consider adding additional authentication or IP allowlist restrictions at the web server or firewall level pending availability of an official patch.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today