PT-2026-90591

CVE-2026-87919

Published

2026-09-12

Updated

2026-09-12

Description by

CVSS 3.1

4.9

Medium

MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Product XML Feed Manager for WooCommerce versions prior to 3.1.1

Description The Product XML Feed Manager for WooCommerce WordPress plugin fails to restrict the object methods that its product shortcode can call and does not verify the user's permissions regarding the targeted product. This allows users with contributor-level access to delete arbitrary WooCommerce products by previewing a post containing the shortcode.

Recommendations Update to version 3.1.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Abdullah Kareem

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers