The EDD Product Catalog Feed by PixelYourSite plugin contains a missing capability check on the wpeddpcf_delete_feed function. This oversight allows any authenticated user with subscriber-level access to delete arbitrary options stored by WordPress. Removing critical configuration options can trigger errors that halt site functionality, effectively denying legitimate users access. The vulnerability is classified as an authorization bypass (CWE‑862) and results in potential loss of availability rather than confidentiality or integrity compromise.

All installations of the PixelYourSite EDD Product Catalog Feed plugin with version 1.0.2 or earlier are affected. The issue resides within the WordPress environment, affecting any site that has installed or enabled this plugin.

The CVSS score of 7.1 indicates a moderate to high severity. No EPSS score is reported and the vulnerability is not listed in the CISA KEV catalog, so current exploit probability is unknown. Nevertheless, the flaw requires only subscriber-level authentication, which is common, and the damage (service interruption) is severe. Administrators should treat this as a serious risk that could be leveraged by attackers who gain or already possess subscriber access.