EUVD-2026-11987Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Cross-Site Request Forgery (CSRF) vulnerability in Josh Kohlbach Product Feed PRO for WooCommerce woo-product-feed-pro allows Cross Site Request Forgery.This issue affects Product Feed PRO for WooCommerce: from n/a through <= 13.5.2.
AnalysisAI
A Cross-Site Request Forgery (CSRF) vulnerability exists in Josh Kohlbach's Product Feed PRO for WooCommerce plugin affecting versions up to 13.5.2, allowing unauthenticated attackers to perform unauthorized actions on behalf of authenticated administrators through malicious web requests. While the CVSS score is 6.5 (Medium), the EPSS score of 0.01% (1st percentile) indicates minimal real-world exploitation probability, suggesting this is a low-priority vulnerability despite the integrity impact. No KEV status or active exploitation evidence is documented.
Technical ContextAI
This CSRF vulnerability (CWE-352) resides in the Josh Kohlbach Product Feed PRO for WooCommerce WordPress plugin (CPE: cpe:2.3:a:josh_kohlbach:product_feed_pro_for_woocommerce:*:*:*:*:*:*:*:*). The plugin handles WooCommerce product feed generation and management. The root cause is insufficient CSRF token validation in the plugin's admin actions, allowing attackers to craft malicious requests that execute administrative functions (such as feed configuration changes, deletion, or export operations) without proper nonce verification. WordPress plugins are particularly susceptible to CSRF when they expose administrative AJAX endpoints or form handlers without adequate wp_nonce validation.
RemediationAI
vendor_patch: Upgrade Product Feed PRO for WooCommerce to version > 13.5.2 (specific patched version not explicitly stated in references; contact vendor or check plugin repository); priority: medium detection: Monitor WordPress admin logs for unusual feed configuration changes, deletions, or exports originating from unauthenticated sessions or unexpected origins workaround: Implement Content Security Policy (CSP) headers with frame-ancestors 'none' to prevent embedded malicious pages from initiating CSRF requests mitigation: Restrict admin access to known IP ranges; use WordPress security plugins (Wordfence, Sucuri) to monitor and block CSRF-like activity patterns
The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before output
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExportFeed.Com Pro
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today