EUVD-2026-109599
GHSA-5r9h-jfp8-wfxv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege WordPress user
-
ExploitSend crafted AJAX request to dfrps_ajax_delete_saved_search
-
ExecutionMissing authorization check passes
-
ImpactDelete saved searches without permission
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privilege WordPress account (CVSS PR:L) on a site with Datafeedr Product Sets Plugin version 1.3.24 or earlier installed and active. The AJAX handler dfrps_ajax_delete_saved_search in functions/ajax.php performs no authorization/capability check (CWE-862), so any logged-in user can invoke it to delete saved searches regardless of their role. Limiting factors: exploitation is not possible unauthenticated (an account is required), no confidentiality is exposed, and impact is restricted to unauthorized deletion of saved-search data (low integrity and availability). No non-default configuration beyond having the vulnerable plugin version active is indicated in the available sources. |
| Impact | This is a low-priority issue despite being remotely reachable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw but requires authentication (PR:L), and impact is confined to low integrity and low availability (VI:L/VA:L) with no confidentiality exposure (VC:N) - consistent with the base score of 2.1 and CWE-862 (Missing Authorization). The vuln.today decision label is 'monitor,' not an urgent action tier, which aligns with the low severity. No EPSS score and no CISA KEV status were provided in the input, so there is no signal of widespread or active exploitation; absence of these is not evidence either way. The description states the exploit is now public and a VulDB submission reference is present, but the input does not confirm working exploit code. The main signals are internally consistent: low severity, authenticated access required, limited data-deletion impact, and a 'monitor' priority. This is a genuine but minor authorization-check defect, not a high-urgency threat; patch during normal maintenance cycles. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege authenticated account on a WordPress site running Datafeedr Product Sets ≤1.3.24 sends a crafted AJAX request to the dfrps_ajax_delete_saved_search handler, which lacks an authorization check, and deletes saved searches they should not be able to remove. The description states the exploit is public; however, the input does not confirm it as verified working exploit code. Impact is limited to unauthorized deletion of saved-search data (low integrity/availability). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
Missing authorization in the Datafeedr Product Sets plugin for WordPress (versions up to and including 1.3.24) allows any logged-in user to delete saved searches they do not own. The AJAX handler dfrps_ajax_delete_saved_search in functions/ajax.php performs no capability check (CWE-862), so an attacker only needs a low-privilege account on the target site-no administrative role is required-to trigger unauthorized state changes. Impact is limited to low integrity and availability (no confidentiality exposure), reflected in the 2.1 CVSS v4.0 score and the assessed CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L; the vulnerability is fixed in 1.3.25, the disclosure states public exploit code exists, and the current priority decision is monitor rather than emergency.
RemediationAI
Vendor-released patch: upgrade Datafeedr Product Sets to version 1.3.25, which the advisory states resolves the missing authorization in dfrps_ajax_delete_saved_search; the fixed build is distributed through the plugin's WordPress.org page at https://wordpress.org/plugins/datafeedr-product-sets/ (patch reference), and the advisory details are at https://vuldb.com/vuln/426175. Because the flaw requires only a logged-in account, treating low-privilege registration as trusted is the exposure multiplier: if the update cannot be applied immediately, deactivating the plugin removes the AJAX handler entirely (side effect: saved searches and product-set functionality stop working), and on sites that allow open or self-service user registration, tightening account provisioning so untrusted users cannot obtain any role reduces the attack surface (side effect: legitimate onboarding friction). Confirming that no unexpected accounts hold subscriber-level or higher access also helps, since such an account is the sole prerequisite. The vendor was contacted before disclosure, and the current priority decision for this CVE is monitor, consistent with the low integrity/availability-only impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Datafeedr Product Sets is a PHP-based WordPress plugin that stores and manages 'saved searches' for product/feed configuration. The affected code lives in functions/ajax.php, in the AJAX handler dfrps_ajax_delete_saved_search, which is reached through WordPress's AJAX request path (admin-ajax.php). The root-cause class is CWE-862 Missing Authorization: the handler deletes a saved-search record without calling current_user_can() or otherwise validating that the requesting user owns or may manage that object, so the only gate is being logged in. The CPE cpe:2.3:a:datafeedr:product_sets_plugin:*:*:*:*:*:*:*:* is version-agnostic, matching the advisory statement that all releases through 1.3.24 are affected. Note that one tag in the intelligence feed labels this an 'Authentication Bypass'; that label overstates the mechanics-the CVSS v4.0 vector carries PR:L and the independent assessment carries PR:L, so authentication is not bypassed, it is merely insufficiently authorized once obtained. The available sources do not state whether the AJAX action is additionally registered for unauthenticated (wp_ajax_nopriv_) requests; the assessed prerequisite is an authenticated low-privilege account, and no non-default configuration beyond having the vulnerable plugin version active is indicated.
Know when Product Sets Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remotely reachable AJAX endpoint (AV:N/AC:L) but requires a logged-in low-privilege user (PR:L); missing authorization allows unauthorized deletion, giving low integrity/availability impact and no confidentiality impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrps_ajax_delete_saved_search of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 1.3.25 can resolve this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB