CVE-2026-116614

Name of the Vulnerable Software and Affected Versions WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping versions prior to 2.24.2

Description An issue exists where insufficient escaping of user-supplied input and lack of proper preparation of SQL queries allow authenticated attackers with editor-level access or higher to perform SQL Injection. By manipulating the sourceId parameter, an attacker can append additional SQL queries to extract sensitive information from the database. This is possible because the plugin grants the edit feeds capability to the Editor role upon activation.

Recommendations Update to a version newer than 2.24.1. Avoid using the sourceId parameter until the update is applied.