Product Feed Manager CVE-2026-15258

Exploitation requires a valid WordPress session authenticated at minimum to the Contributor role; unauthenticated exploitation is not possible per the CVSS PR:L vector. The Product Feed Manager For WooCommerce plugin must be installed and active on the target site - sites not running this specific plugin are unaffected. The vulnerable code path is the product-feed custom filter rules feature, so only deployments where this functionality is accessible to the authenticated user are at risk; no non-default server or PHP configuration is required beyond plugin activation. The primary limiting factor is the need for a Contributor account: sites with disabled user registration, tightly controlled contributor lists, or strong credential hygiene face substantially lower real-world risk. Sites with open registration that defaults to Contributor role are at materially higher risk.

The CVSS 3.1 score of 8.1 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N is internally consistent: network-accessible, low complexity, and yields high confidentiality and integrity impact - a genuine high-severity rating. However, the PR:L constraint (Contributor role required) is the critical mitigating factor that the raw score underweights in many deployment contexts. The EPSS score of 0.16% at the 5th percentile is notably low despite a publicly available POC, strongly suggesting that acquiring a Contributor account is a meaningful real-world barrier preventing widespread automated exploitation. The absence from CISA KEV further corroborates that confirmed active exploitation has not been observed at scale. For organizations with open WordPress registration that grants Contributor access, or with many trusted contributor accounts (e.g., multi-author blogs, WooCommerce storefronts with staff accounts), effective risk is substantially higher than EPSS alone implies. No conflicting signals between data sources were identified; all sources are consistent.

An attacker who has acquired Contributor-level WordPress credentials - through phishing, credential stuffing against exposed wp-login.php, or self-registration on a site with open enrollment - logs into the WordPress dashboard and navigates to the Product Feed Manager's custom filter rule configuration. The attacker injects a UNION-based or boolean-blind SQL payload into a filter rule field, causing the backend SQL query to return arbitrary database content, including WordPress password hashes (wp_users table) and WooCommerce customer order records. A publicly available POC lowers the technical barrier significantly, making this exploitable by low-skilled attackers who can obtain Contributor credentials.