CVE-2026-116107

Datafeedr Product Sets Plugin AJAX Handlers ajax.php dfrps_ajax_delete_saved_search authorization

View on CVE.org
Published Oct 26, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrps_ajax_delete_saved_search of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 1.3.25 can resolve this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.

Analysis

AI-generated

Technical impact

The vulnerability allows an attacker to send an unauthenticated request to the dfrps_ajax_delete_saved_search handler, causing any saved search to be removed from the system. This results in loss of user data and potential disruption of services that rely on these saved searches, but does not provide remote code execution or other system compromise.

Affected Systems

WordPress sites running the Datafeedr Product Sets Plugin are affected. Versions up to and including 1.3.24 contain the issue; the code located in functions/ajax.php under the AJAX Handlers component is responsible.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS is not available and the vulnerability is not listed in KEV, but the public exploit demonstrates that the issue can be leveraged remotely from any external host with network access. The lack of authorization checks on the AJAX endpoint makes exploitation straightforward; an attacker can delete saved searches with minimal effort, leading to immediate data loss for users

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Datafeedr Product Sets Plugin to version 1.3.25 or later. This release removes the missing authorization check.
  • Modify the plugin or add custom code to ensure that only users possessing the appropriate capability can trigger the delete operation, and verify this capability before executing the deletion logic.
  • If an update is not possible immediately, block or filter external requests to the delete AJAX handler, or add a nonce verification step to ensure only legitimate, authenticated requests reach the endpoint.

Generated by OpenCVE AI on October 26, 2026 at 03:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrps_ajax_delete_saved_search of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 1.3.25 can resolve this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.
Title Datafeedr Product Sets Plugin AJAX Handlers ajax.php dfrps_ajax_delete_saved_search authorization
First Time appeared Datafeedr
Datafeedr product Sets Plugin
Weaknesses CWE-862
CWE-863
CPEs cpe:2.3:a:datafeedr:product_sets_plugin:*:*:*:*:*:*:*:*
Vendors & Products Datafeedr
Datafeedr product Sets Plugin
References
Metrics cvssV2_0

{'score': 5.5, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 5.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Nov 2, 2026, 4:48 PM
Reserved
Oct 25, 2026, 7:58 AM

View source JSON

Updated
Nov 2, 2026, 4:48 PM

JSON

Status
Deferred
Published
Oct 26, 2026, 2:17 AM
Modified
Nov 2, 2026, 5:17 PM

View source JSON

No data.

Updated
Oct 26, 2026, 3:30 AM

JSON