Product Feed For Google Shopping Microsoft Advertising And 40 Channels For Woocommerce Merchant
Monthly
Unauthenticated visitors to any WordPress site running the 'Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant' plugin below version 5.3.2 can invoke an AJAX action that re-registers the store with the plugin's feed service and overwrites the stored shop secret, because that action performs neither a nonce nor a capability check (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). The impact is integrity-only and confined to the plugin's feed registration state - there is no code execution, data disclosure, or site takeover path - and publicly available exploit code exists per the WPScan advisory. Real-world urgency is low: EPSS is 0.17% (5th percentile) and the CISA SSVC assessment records exploitation as 'none', with only the plugin version being a precondition.
Unauthenticated visitors to any WordPress site running the 'Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant' plugin below version 5.3.2 can invoke an AJAX action that re-registers the store with the plugin's feed service and overwrites the stored shop secret, because that action performs neither a nonce nor a capability check (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). The impact is integrity-only and confined to the plugin's feed registration state - there is no code execution, data disclosure, or site takeover path - and publicly available exploit code exists per the WPScan advisory. Real-world urgency is low: EPSS is 0.17% (5th percentile) and the CISA SSVC assessment records exploitation as 'none', with only the plugin version being a precondition.