Description
The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by previewing a post that contains the shortcode.
Published: 2026-09-12
Score: 4.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Deletion of WooCommerce Products
Action: Patch Now
AI Analysis

Impact

The Product XML Feed Manager for WooCommerce plugin prior to version 3.1.1 fails to restrict the method invoked by its product shortcode and does not verify a user’s capability against the target product. As a result, any contributor can delete any WooCommerce product by previewing a post containing the shortcode, leading to loss of inventory listings, potential revenue impact, and damage to data integrity.

Affected Systems

The vulnerability affects installations of the WordPress plugin Product XML Feed Manager for WooCommerce. Users with contributor-level access and the ability to edit or preview posts that include the product shortcode are required for exploitation.

Risk and Exploitability

The CVSS score of 4.9 and EPSS score of < 1% indicate a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only legitimate contributor permissions and post preview access, without external network interaction, so the attack surface is limited to the local WordPress environment.

Generated by OpenCVE AI on September 15, 2026 at 18:14 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Product XML Feed Manager for WooCommerce to version 3.1.1 or later.
  • Restrict contributor privileges for users who should not enforce strict access control.
  • Disable or restrict the product shortcode preview feature for contributors so that the deletion action cannot be triggered via post preview.

Generated by OpenCVE AI on September 15, 2026 at 18:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 12 Sep 2026 19:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Sat, 12 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-862
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 12 Sep 2026 09:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Sat, 12 Sep 2026 06:15:00 +0000

Type Values Removed Values Added
Description The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by previewing a post that contains the shortcode.
Title Product XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Product Deletion via Shortcode
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-09-12T15:28:04.091Z

Reserved: 2026-09-09T16:01:19.136Z

Link: CVE-2026-87919

cve-icon Vulnrichment

Updated: 2026-09-12T15:14:13.369Z

cve-icon NVD

Status : Deferred

Published: 2026-09-12T06:16:28.537

Modified: 2026-09-14T21:10:17.423

Link: CVE-2026-87919

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T18:15:11Z

Weaknesses