CVE-2026-87919
Product XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Product Deletion via Shortcode
CVSS Score
4.9
EPSS Score
0.0%
EPSS Percentile
0th
The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by previewing a post that contains the shortcode.
| Vendor | unknown |
| Product | product xml feed manager for woocommerce |
| Published | Sep 12, 2026 |
| Last Updated | Sep 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown product xml feed manager for woocommerce
Be the first to know when new medium vulnerabilities affecting unknown product xml feed manager for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Product XML Feed Manager for WooCommerce
0 < 3.1.1
References
Credits
Abdullah Kareem (cyberkareem) WPScan