Product Feed Manager CVE-2026-118089

Exploitation requires an authenticated WooCommerce shop manager account on a WordPress site running Product Feed Manager (best-woocommerce-feed) version 7.14.1 or earlier; per the CVSS vector (PR:H) this is a high-privilege, not anonymous, attack. The flaw is PHP Object Injection where plugin code deserializes attacker-supplied input, but the specific feature, endpoint, and trigger are not described in the available sources. The practical ceiling on impact is the need for that privileged role plus the availability of a usable POP gadget chain in the plugin, WordPress core, or another installed component - absent such a chain, object injection alone may not yield code execution. There is no required user interaction (UI:N) and complexity is low (AC:L) once the role is held.

This is a genuine but conditional risk rather than an internet-wide emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 High) indicates network-reachable, low-complexity exploitation with full confidentiality, integrity and availability impact, but the PR:H metric is decisive: an attacker must already hold a high-privilege WooCommerce role (shop manager) before the PHP Object Injection (CWE-502) can be reached. The vuln.today decision label is 'this_week', which signals meaningful priority but not act_now/emergency urgency. No EPSS probability was supplied, there is no CISA KEV listing, and there is no confirmed public exploit - so exploitation status is 'no public exploit identified at time of analysis'. The signals are internally consistent (a privileged-attacker deserialization bug reported by Patchstack), with no CVSS-vs-description conflict. The main caveat is that real impact depends entirely on whether a usable POP (property-oriented programming) gadget chain is present in the plugin, WordPress core, or co-installed plugins; the advisory does not confirm one, so unauthenticated-equivalent severity should not be assumed. EPSS is absent (not an error) and no active exploitation is claimed, so this reads as a patch-this-cycle item, not a drop-everything one.

An attacker who has obtained or been granted a WooCommerce shop manager account on a WordPress site running Product Feed Manager (best-woocommerce-feed) <= 7.14.1 submits a crafted serialized PHP object to a plugin feature that deserializes untrusted input. If a suitable gadget chain exists in the application, deserialization triggers it, potentially leading to code execution, data disclosure, or site compromise (C:H/I:H/A:H). No public, verified exploit code is identified at the time of analysis, and the precise trigger is not described in the available sources.