EUVD-2026-72677
GHSA-hqcf-pj53-9jm6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain subscriber-level WordPress credentials
-
DeliverySend authenticated AJAX POST to wp-admin/admin-ajax.php
-
ExploitInvoke wpeddpcf_delete_feed without capability check
-
ExecutionDelete critical wp_options entry (e.g., active_plugins)
-
PersistTrigger site-wide PHP fatal errors
-
ImpactDeny service to all users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress account with at minimum the subscriber role; any higher role (contributor, author, editor, administrator) is also affected. The site must have the EDD Product Catalog Feed by PixelYourSite plugin (≤1.0.2) installed and activated. User self-registration must be enabled on the site, or the attacker must obtain credentials through another means-closed-registration sites significantly reduce exposure. No specific plugin feature needs to be configured beyond the plugin being active; the vulnerable AJAX endpoint is registered at plugin activation. The attack is limited to integrity and availability impact only-no confidentiality data is exposed, and no escalation to code execution is described. |
| Impact | The CVSS 7.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) reflects a low-complexity, network-accessible attack requiring only a subscriber-level credential-the lowest registered user role in WordPress. The PR:L bar is non-trivial but realistically attainable on any EDD storefront with open user registration, which is common for digital goods sellers. The provided CVSS rates A:L, but the description explicitly states the result can deny service to all legitimate users; deletion of active_plugins or siteurl causes PHP fatal errors site-wide, which is functionally A:H-the provided availability metric appears understated. No KEV listing and no known POC mean exploitation is theoretical at this time; EPSS data was not provided. Real-world risk is moderate-to-high for affected sites with open registration, but the plugin's narrow deployment footprint limits aggregate exposure. |
| Exploit ScenarioDerived | An attacker registers a free subscriber account on a WordPress-based digital goods store running EDD with this plugin activated, or obtains credentials via a separate low-cost method such as credential stuffing. The attacker sends a crafted authenticated POST request to wp-admin/admin-ajax.php invoking wpeddpcf_delete_feed with the target option name set to active_plugins. WordPress deletes the option without checking the caller's capability, causing every subsequent page load to throw a fatal PHP error, taking the site completely offline for all visitors and administrators. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
The wpeddpcf_delete_feed AJAX handler in EDD Product Catalog Feed by PixelYourSite (WordPress plugin, all versions ≤1.0.2) omits a capability check, allowing any authenticated subscriber-level user to invoke the function and delete arbitrary entries from the WordPress options table. An attacker who deletes a critical option-such as active_plugins, siteurl, or the active theme-can render the entire WordPress installation non-functional, denying service to all legitimate users. No public exploit code or CISA KEV listing exists at time of analysis; Wordfence reported and disclosed the vulnerability.
RemediationAI
Update the EDD Product Catalog Feed by PixelYourSite plugin to a version beyond 1.0.2; verify the latest available release at https://www.pixelyoursite.com/plugins/easy-digital-downloads-product-catalog-feed and via the WordPress plugin repository. A patched version is not specified in the available advisory data, so monitor the vendor page and the Wordfence entry at https://www.wordfence.com/threat-intel/vulnerabilities/id/145cae1e-1e38-49bb-a63f-204246de6a37 for confirmation. If no patch is yet available, deactivate the plugin temporarily to eliminate the vulnerable AJAX handler from the attack surface-this will disable catalog feed functionality. As a compensating control, disable open user registration (Settings → General → Anyone can register) to prevent untrusted subscribers from obtaining credentials; this closes the primary attack path while the plugin remains active. If exploitation is suspected, audit the wp_options table for recently deleted critical entries and restore from backup.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WordPress plugins register AJAX action handlers that must gate privileged operations with current_user_can() capability checks before executing. CWE-862 (Missing Authorization) describes this exact pattern: a state-modifying function is exposed via wp-ajax.php without verifying the caller's role or permission level. The affected function wpeddpcf_delete_feed operates against the WordPress wp_options table, which stores foundational site configuration including the active plugin list, active theme, permalink structure, database schema version, and site URLs. The CPE cpe:2.3:a:pixelyoursite:edd_product_catalog_feed_by_pixelyoursite covers all versions through 1.0.2 of this Easy Digital Downloads add-on plugin.
Know when Edd Product Catalog Feed By Pixelyoursite gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Deleting critical WordPress options (e.g., active_plugins, siteurl) causes complete site failure for all users, warranting A:H rather than the provided A:L.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcf_delete_feed function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.
Articles & Coverage 2
Executive ViewAI
The EDD Product Catalog Feed WordPress plugin (versions 1.0.2 and earlier) allows any WordPress user with subscriber-level access to completely disable websites by deleting critical configuration settings. Organizations using this plugin face immediate service disruption risk, particularly where subscriber-level accounts are granted to content contributors or client users.
No vendor-released patch identified at time of analysis. Immediate mitigations: deactivate the affected plugin, or restrict AJAX endpoint access to administrator-level users via server configuration; minimize subscriber-level user accounts on production sites; implement continuous backup and versioning of WordPress configuration; monitor database logs for unauthorized options table modifications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB