EUVD-2026-92593
GHSA-mchg-wqjh-wq83
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-reachable admin input (AV:N, AC:L) requiring high-privilege authentication (PR:H), no user interaction, with object injection yielding full C/I/A impact when a gadget chain is present.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7.
Articles & Coverage 1
AnalysisAI
Authenticated attackers with high privileges can exploit a PHP Object Injection vulnerability in Product Feed PRO for WooCommerce (versions up to 13.5.7) to potentially execute arbitrary code, delete files, or perform other malicious actions. The flaw stems from deserialization of untrusted data (CWE-502), and successful exploitation hinges on the presence of a reachable POP gadget chain in the targeted site's code; without such a chain, impact may be limited. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with high privileges (PR:H - effectively administrator or equivalent access to the vulnerable plugin functionality), after which the attacker must deliver attacker-controlled serialized data to a plugin code path that calls unserialize() on untrusted input. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a PHP Object Injection flaw (CWE-502) in the Product Feed PRO for WooCommerce plugin, rated CVSS 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every WordPress and WooCommerce instance running Product Feed PRO at version 13.5.7 or earlier, confirm whether an update beyond 13.5.7 has been published by the vendor, and if none exists, disable or remove the plugin on any storefront where it is not business-critical; where the plugin must remain active, tighten administrative access so that only a small, named group holds elevated roles, enforce multi-factor authentication for those accounts, and add WAF or application-layer rules that flag or block PHP serialized object payloads in plugin-related request parameters. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before output
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExportFeed.Com Pro
A Cross-Site Request Forgery (CSRF) vulnerability exists in Josh Kohlbach's Product Feed PRO for WooCommerce plugin affe
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today