Product Feed PRO for WooCommerce <= 13.5.7 - Authenticated (Shop Manager+) PHP Object Injection via Product Attribute Meta
- ID
- WPSEC-2026-0092
- Plugin
- Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce (woo-product-feed-pro)
- Affected
- all versions before 13.5.8
- Remediation
- Update to 13.5.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-502
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Product Feed PRO for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Product Feed PRO for WooCommerce by AdTribes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 13.5.7 due to deserialization of untrusted input via a bare unserialize() call on product attribute meta. This makes it possible for authenticated attackers with Shop Manager-level access and above, who can write raw serialized data to product meta (for example through XML-RPC), to inject a PHP object that is instantiated when the plugin reads the meta, such as during feed generation. No known POP chain is present in the plugin itself; if a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
References
- https://wpsec.com/vuln/WPSEC-2026-0092/
- https://plugins.svn.wordpress.org/woo-product-feed-pro/tags/13.5.8/
- https://wordpress.org/plugins/woo-product-feed-pro/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS