Product Catalog Feed CVE-2026-118078

Exploitation requires an authenticated WordPress/WooCommerce user holding the Shop manager role (not an anonymous visitor), who can reach the Product Catalog Feed by PixelYourSite plugin feature that unsafely deserializes attacker-supplied data (CWE-502 PHP Object Injection) in versions <= 3.1.4. Realized impact additionally depends on a usable PHP POP gadget chain being present in the plugin, WordPress core, or other installed components; the specific vulnerable parameter and trigger are not described in the available sources. Principal limiting factor: the Shop manager privilege requirement (PR:H) confines practical exploitation to insiders, privilege-chaining, or compromised store-manager credentials; no user interaction is required (UI:N) once that access exists.

This is a genuine but conditional risk rather than a drop-everything emergency, and the signals are mostly consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, 7.2 High) describes a network-reachable, low-complexity flaw whose single gating factor is PR:H - the flaw requires an authenticated account with elevated privileges, consistent with the title 'Shop manager PHP Object Injection.' The vuln.today decision label is 'this_week,' which aligns with a High-severity authenticated issue that should be patched promptly but is not flagged act_now/emergency. No CISA KEV listing, no EPSS probability, and no proof-of-concept are present in the supplied data, so there is no evidence of active or imminent mass exploitation. The dominant limiter is the Shop manager privilege requirement: exploitation presupposes an attacker who already holds (or has compromised) a trusted WooCommerce store-management account, which narrows the realistic threat to insider abuse, privilege-chaining, or compromised-credential scenarios rather than anonymous internet-wide attacks. A further unstated dependency for CWE-502 PHP object injection is the availability of a usable POP gadget chain in the plugin, WordPress core, or other installed code; whether such a chain yields the full C:H/I:H/A:H impact is not documented in the sources. Net: a real priority to patch for sites that provision Shop manager accounts, but materially de-prioritized versus an unauthenticated (PR:N) object-injection bug.

An attacker who controls a Shop manager account (via insider access, phishing, or credential compromise) submits crafted serialized data to the vulnerable Product Catalog Feed functionality, which deserializes it unsafely and instantiates attacker-chosen PHP objects. If a suitable gadget chain is present, this can escalate to code execution or data compromise on the WordPress host. No public exploit or PoC is identified in the available data, and the exact triggering parameter is not described in the sources.