EUVD-2026-51427
GHSA-2j6p-mqrp-cf4j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-exploitable web interface requires only Contributor credentials (PR:L); full SQL access yields high C/I; no destructive availability impact from standard SQLi.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks.
Articles & Coverage 1
AnalysisAI
SQL injection in the Product Feed Manager For WooCommerce WordPress plugin (versions prior to 7.6.1) allows authenticated users holding a Contributor role or higher to execute arbitrary SQL statements against the WordPress database by crafting malicious product-feed custom filter rules. High CVSS impact metrics (C:H, I:H) reflect the potential for full database read and write access, including extraction of user credentials, WooCommerce order records, and site configuration data. A publicly available exploit exists per WPScan, though the EPSS score of 0.16% (5th percentile) suggests active mass exploitation has not materialized; the vulnerability is not listed in CISA KEV at time of analysis.
Technical ContextAI
The vulnerability is located in the Product Feed Manager For WooCommerce WordPress plugin (CPE: cpe:2.3:a:unknown:product_feed_manager_for_woocommerce:*:*:*:*:*:*:*:*), a plugin that generates product feeds for external platforms such as Google Shopping and Facebook Catalog. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the plugin dynamically constructs SQL queries incorporating user-supplied custom filter rule inputs without adequate sanitization or parameterization, bypassing WordPress's $wpdb->prepare() or equivalent escaping mechanisms. Product feed filter rules translate conditional logic (e.g., 'show products where category = X') into SQL predicates, and the lack of output escaping on these rule values creates a classic second-order or direct injection surface accessible to any authenticated WordPress user at or above Contributor level. The CPE vendor field is listed as 'unknown', indicating NVD has not yet assigned a fully resolved CPE entry.
RemediationAI
Update the Product Feed Manager For WooCommerce plugin to version 7.6.1 or later, which introduces proper sanitization and escaping of custom filter rule inputs before SQL query construction. The patch is available via the standard WordPress plugin dashboard or the plugin repository; consult the WPScan advisory at https://wpscan.com/vulnerability/9e20442b-047b-46fe-be72-89c637deb6bc/ for confirmation. If immediate patching is not feasible, restrict the number of accounts granted the Contributor role or above - reducing trusted contributors directly reduces the exploitable attack surface, with the trade-off of limiting content authorship. Deploying a WAF with SQL injection ruleset (e.g., ModSecurity with OWASP CRS) on the product feed admin endpoints can partially block exploitation but should not substitute for patching, as WAF bypass is common with SQLi. Disabling open user registration, if currently enabled, prevents unauthenticated adversaries from self-provisioning Contributor accounts to exploit this flaw.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today