Product Feed WooCommerce CVE-2026-87968

The target WordPress site must have the 'Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant' plugin installed and active at a version below 5.3.2. The vulnerable AJAX action that registers the store with the feed service performs no nonce (CSRF) check and no capability check and is exposed to unauthenticated users, so no authentication, no specific non-default setting, and no user interaction are required (consistent with AV:N/AC:L/PR:N/UI:N). The limiting factors are scope and impact rather than access: exploitation only affects the plugin's stored shop secret / feed re-registration (integrity-only, I:L) and does not grant code execution, data disclosure, or site takeover; the sole precondition beyond network reachability is that the vulnerable plugin version is present and the feed registration feature is in use.

This is a medium-severity, integrity-only access-control flaw (CWE-284), and the signals are consistent in pointing to limited real-world urgency rather than an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3) shows remote, low-complexity, unauthenticated exploitation but with only a LOW integrity impact and NO confidentiality or availability impact - the attacker can overwrite the stored shop secret and force re-registration, not take over the site or read data. EPSS is low at 0.17% (5th percentile), and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation; SSVC agrees (Exploitation: none). The counter-signals are that publicly available exploit code exists (WPScan) and SSVC marks the issue Automatable: yes with partial technical impact, meaning opportunistic/mass scanning against WordPress/WooCommerce sites is plausible even though impact per victim is modest. Net: treat as a routine-priority patch (disruption of the Google/Microsoft product-feed integration), not a high-urgency incident. Note the signal tension to resolve operationally: POC availability + automatable does not equal active exploitation, and low EPSS + no KEV reinforce that this is currently a theoretical/opportunistic risk rather than a widespread campaign.

An attacker sends a crafted request to the plugin's unauthenticated AJAX registration action against any vulnerable WooCommerce store, forcing it to re-register with the feed service and overwriting the stored shop secret. Because no nonce or capability check is enforced, no login or user interaction is needed, and publicly available exploit code (WPScan) lowers the bar further. The result is disruption or hijacking of the store's product-feed registration rather than full site compromise.