Product Feed Manager EUVD-2026-81501

Requires an authenticated account with at least Contributor role on a WordPress site running Product Feed Manager (best-woocommerce-feed) version 7.12.0 or earlier; exploitation is remote (AV:N), low-complexity (AC:L), and needs no user interaction (UI:N). The practical limiting factor is the Contributor-level authentication (PR:L): risk is elevated on sites that allow open user registration or grant Contributor/author roles broadly, and substantially lower on single-admin sites where low-privilege accounts do not exist. No non-default plugin configuration is stated as required.

This is an authenticated SQL injection (CWE-89) requiring at least Contributor-level access to the WordPress site, confirmed by the CVSS vector's PR:L and the description's explicit 'Contributor' qualifier. The Patchstack CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5) reflects network-reachable, low-complexity exploitation with high confidentiality loss and a claimed scope change. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - the 8.5 is a severity rating, not evidence of active abuse. The real-world priority is moderate rather than urgent: exploitation is gated behind a valid Contributor account, which is a meaningful barrier on well-managed sites but trivial on sites with open registration or loose role assignment. Two signals warrant scrutiny: Patchstack's S:C (scope change) is questionable for a WordPress-internal DB query where the database is the same security authority, and I:N is unusual for SQLi (injection often permits writes as well as reads); these vendor choices are not independently verifiable from the single reference. Overall: a genuinely high-severity flaw for multi-author sites, but the authentication requirement and absence of any exploitation/EPSS/KEV signal place it below internet-facing unauthenticated criticals in triage order.

An attacker who holds or registers a Contributor account on a WordPress site running Product Feed Manager <= 7.12.0 submits a crafted parameter to a plugin endpoint that concatenates input into a SQL query, extracting sensitive database contents such as user password hashes, secret keys, or other users' private data. No public proof-of-concept is identified in the provided data, and exploitation requires valid low-privilege authentication (PR:L) but no user interaction and low complexity.