What is the CVSS score of CVE-2026-3499?

CVE-2026-3499 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3499?

Product Feed PRO for WooCommerce (versions 13.4.6-13.5.2.1) contains a CSRF vulnerability that allows attackers to manipulate feed configurations and delete critical product data by tricking…

How to fix or mitigate CVE-2026-3499?

Within 24 hours: Identify all WordPress installations running Product Feed PRO for WooCommerce and document current versions. Within 7 days: Update to version 13.5.3 or later via WordPress plugin repository or AdTribes official channels; verify update completion across all sites. Within 30 days: Audit feed management logs for unauthorized changes; reset WordPress administrator sessions; implement Web Application Firewall (WAF) rules to block suspicious cross-site requests targeting feed management endpoints.

WordPress CVE-2026-3499

EUVD-2026-20026 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-08 Wordfence

WordPress CSRF

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 08, 2026 - 01:45 euvd

EUVD-2026-20026

Analysis Generated

Apr 08, 2026 - 01:45 vuln.today

CVE Published

Apr 08, 2026 - 01:24 nvd

HIGH 8.8

DescriptionCVE.org

The Product Feed PRO for WooCommerce by AdTribes - Product Feeds for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 13.4.6 through 13.5.2.1. This is due to missing or incorrect nonce validation on the ajax_migrate_to_custom_post_type, ajax_adt_clear_custom_attributes_product_meta_keys, ajax_update_file_url_to_lower_case, ajax_use_legacy_filters_and_rules, and ajax_fix_duplicate_feed functions. This makes it possible for unauthenticated attackers to trigger feed migration, clear custom-attribute transient caches, rewrite feed file URLs to lowercase, toggle legacy filter and rule settings, and delete duplicated feed posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery (CSRF) in Product Feed PRO for WooCommerce by AdTribes versions 13.4.6 through 13.5.2.1 allows unauthenticated attackers to manipulate critical feed management functions by tricking authenticated WordPress administrators into executing malicious requests. Exploitation enables attackers to trigger feed migrations, clear custom-attribute caches, modify feed file URLs, alter legacy filter settings, and delete feed posts without proper authorization. EPSS exploitation probability data not available; no confirmed active exploitation (not in CISA KEV) identified at time of analysis. Wordfence reported this vulnerability with patches available via WordPress plugin repository.

Technical ContextAI

This vulnerability stems from inadequate CSRF token (nonce) validation in five AJAX handlers within the Product Feed PRO for WooCommerce WordPress plugin (CPE: cpe:2.3:a:jkohlbach:product_feed_pro_for_woocommerce_by_adtribes_-_product_feeds_for_woocommerce). The affected functions-ajax_migrate_to_custom_post_type, ajax_adt_clear_custom_attributes_product_meta_keys, ajax_update_file_url_to_lower_case, ajax_use_legacy_filters_and_rules, and ajax_fix_duplicate_feed-process state-changing operations without properly verifying WordPress nonces that prove request legitimacy. CWE-352 (Cross-Site Request Forgery) occurs when web applications fail to validate that requests originate from authenticated users performing intentional actions rather than from attacker-controlled pages. WordPress plugins commonly use nonces (cryptographic tokens) to prevent CSRF attacks against admin functionality; their absence or improper implementation creates exploitable gaps in multi-user environments where administrators frequently access external content.

RemediationAI

Upgrade immediately to Product Feed PRO for WooCommerce by AdTribes version 13.5.2.2 or later, which implements proper nonce validation for the affected AJAX functions. The patch is available through the WordPress plugin repository with changeset details documented at https://plugins.trac.wordpress.org/changeset/3476067/woo-product-feed-pro. WordPress administrators should update via the Plugins dashboard (Dashboard > Plugins > Installed Plugins, locate 'Product Feed PRO', click 'Update Now'). For environments where immediate updates cannot be deployed, implement temporary workarounds by restricting administrator access to trusted networks only, enforcing strict Content Security Policy headers to limit external resource loading, and educating administrators about CSRF attack vectors (never clicking unknown links while logged into WordPress admin). Review plugin access logs for suspicious AJAX requests to the five affected endpoints during the vulnerable period. No configuration changes alone can mitigate this vulnerability-code-level patching is required for complete remediation.