Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce <= 13.5.8 - Authenticated (Contributor+) Path Traversal via Feed File Name and Format
- ID
- WPSEC-2026-3118
- Plugin
- Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce (woo-product-feed-pro)
- Affected
- from 13.3.5 before 13.5.9
- Remediation
- Update to 13.5.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- Weakness
- CWE-22
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-13
- Attack surface
- Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Product Feed PRO for WooCommerce by AdTribes plugin for WordPress is vulnerable to Path Traversal via the feed file name and file format in all versions up to, and including, 13.5.8. The feed file_name and file_format meta are joined into file paths without validation. The adt_product_feed post type was also registered with the default 'post' capabilities, so any user with edit_posts can create a draft feed and set these values through XML-RPC. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, or to have feed files written outside the feed directory or with arbitrary extensions, when an administrator deletes, deactivates, or refreshes the planted feed. Deleting a file such as wp-config.php can lead to full site compromise.
References
- https://wpsec.com/vuln/WPSEC-2026-3118/
- https://plugins.svn.wordpress.org/woo-product-feed-pro/tags/13.5.9/
- https://wordpress.org/plugins/woo-product-feed-pro/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS