Description
The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visitor can force the store to re-register and overwrite the Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2's stored shop secret.
Published: 2026-10-14
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated Store Re-registration
Action: Apply Patch
AI Analysis

Impact

The plugin does not perform a nonce or capability check on the AJAX action that registers the store with its feed service, allowing any visitor to force the store to re‑register and overwrite the stored shop secret. This can alter plugin configuration and disrupt connectivity to external advertising services.

Affected Systems

WordPress sites running Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant plugin versions earlier than 5.3.2 are affected.

Risk and Exploitability

With a CVSS score of 5.3 and an EPSS score below 1 %, the vulnerability is of moderate severity and is not currently listed in the CISA KEV catalog. The attack vector is a web request to an unauthenticated AJAX endpoint, so any user who can reach the site can trigger the exploitation.

Generated by OpenCVE AI on October 16, 2026 at 00:31 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the plugin to version 5.3.2 or later.
  • If an upgrade is not immediately possible, restrict access to the vulnerable AJAX action using a firewall rule or .htaccess restriction.
  • Verify that the store secret is no longer exposed by inspecting the plugin settings and restore the original configuration if necessary.

Generated by OpenCVE AI on October 16, 2026 at 00:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Wed, 14 Oct 2026 06:45:00 +0000

Type Values Removed Values Added
Description The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visitor can force the store to re-register and overwrite the Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2's stored shop secret.
Title Product Feed for Google Shopping < 5.3.2 - Unauthenticated Forced Store Registration
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-14T13:42:21.110Z

Reserved: 2026-09-09T17:53:41.106Z

Link: CVE-2026-87968

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-14T07:17:04.070

Modified: 2026-10-14T16:14:02.800

Link: CVE-2026-87968

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T00:45:17Z

Weaknesses