The vulnerability is a missing authorization flaw that allows an attacker to access or manipulate the XML feed manager interface without proper permission checks. This flaw could enable a user to view or modify feed data, potentially exposing sensitive product information or injecting malicious entries. The weakness is identified as CWE‑862 and can lead to unauthorized data exposure and integrity compromise. The official severity is a CVSS score of 6.5, indicating a moderate impact when exploited. The EPSS score is reported as < 1%, suggesting a low probability of widespread exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be through the WordPress site’s authenticated session; an attacker with any user access could potentially reach the feed manager pages because the plugin lacks proper access control. If the user lacks sufficient privileges, the plugin’s missing checks create a privilege escalation risk. The impact could be system‑wide if the attacker gains administrator rights, but only the scope of the XML feed manager is directly affected.

WPFactory’s Product XML Feed Manager for WooCommerce is affected, versions through 2.9.2 inclusive. Vendors: WPFactory; product: Product XML Feed Manager for WooCommerce. No specific version ranges were provided beyond <= 2.9.2, so all releases up to and including 2.9.2 are potentially vulnerable.

With a CVSS score of 6.5 the risk is moderate, yet the low EPSS (<1%) suggests it is not yet actively exploited. Because the flaw results from missing authorization checks rather than a buffer overflow or code injection, it typically requires the attacker to authenticate to the WordPress backend or to access the management URLs directly. The vulnerability is not referenced in KEV, so it is not yet widely leveraged by mass exploits. The recommended approach is to treat it as a moderate‑risk issue: immediately patch if an update is available, otherwise implement access restrictions and monitor for unauthorized activity. Implementing a stricter role‑based access control on the feed manager URLs can reduce exploitation likelihood until a patch is applied.