EUVD-2026-59590
GHSA-fh86-r3fp-p9cq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable unauthenticated REST read; high confidentiality due to business-sensitive config exposure; no integrity or availability impact.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
5DescriptionCVE.org
The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowing unauthenticated users to disclose a store's feed configuration (rules, filters and field mapping) and to enumerate the full product category taxonomy.
AnalysisAI
Unauthenticated information disclosure in Product Feed PRO for WooCommerce by AdTribes (WordPress plugin) before version 13.5.7 exposes sensitive WooCommerce store configuration to any remote party without credentials. A missing authorization check on a REST API read route allows retrieval of feed rules, filters, and field mappings - internal merchandising logic that store operators typically treat as proprietary business configuration. Additionally, the full product category taxonomy can be enumerated, enabling competitive intelligence gathering. No public exploit or CISA KEV listing exists at time of analysis, and the EPSS score of 0.14% (4th percentile) indicates low observed exploitation probability despite the straightforward unauthenticated attack vector.
Technical ContextAI
The vulnerability resides in a WordPress REST API endpoint registered by the Product Feed PRO for WooCommerce plugin developed by AdTribes. WordPress REST routes require explicit permission callbacks to enforce access control; CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) indicates the root cause is an absent or bypassed authorization check - specifically the callback that would normally verify user identity and capability before serving data. The exposed data includes feed configuration objects (rules determining which products enter feeds, filter conditions, and field-to-feed mapping), as well as WooCommerce product category taxonomy terms. This type of route is commonly exposed on the /wp-json/ namespace and is reachable without authentication by default in WordPress unless the REST API is explicitly restricted. Affected versions span all releases of the plugin prior to 13.5.7 per EUVD-2026-59590.
RemediationAI
Update the Product Feed PRO for WooCommerce plugin to version 13.5.7 or later, which introduces the missing authorization check on the affected REST read route. The fix is confirmed available per vendor advisory referenced via WPScan (https://wpscan.com/vulnerability/87fe63af-5a43-4812-88ce-568b1cc1598f/) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-16611). If immediate patching is not possible, a targeted workaround is to restrict unauthenticated access to the WordPress REST API at the web server or WAF level - for example, by blocking requests to /wp-json/ from unauthenticated clients using a WAF rule or WordPress plugin such as 'Disable REST API'. Trade-off: blanket REST API restriction may break legitimate integrations (e.g., Gutenberg editor, WooCommerce cart endpoints) and should be scoped to the specific route prefix used by this plugin if identifiable. No other compensating controls adequately address the root authorization bypass.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today