# Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce <= 13.5.8 - Authenticated (Contributor+) Path Traversal via Feed File Name and Format

- **ID:** WPSEC-2026-3118
- **Plugin:** Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce (`woo-product-feed-pro`), https://wordpress.org/plugins/woo-product-feed-pro/
- **Affected versions:** from 13.3.5 before 13.5.9
- **Fixed in:** 13.5.9 (Update to 13.5.9 or later.)
- **Severity:** High 8.0 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-22
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woo-product-feed-pro
- **Fix released:** 2026-11-13
- **Published:** 2026-11-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3118/

## Description

The Product Feed PRO for WooCommerce by AdTribes plugin for WordPress is vulnerable to Path Traversal via the feed file name and file format in all versions up to, and including, 13.5.8. The feed file_name and file_format meta are joined into file paths without validation. The adt_product_feed post type was also registered with the default 'post' capabilities, so any user with edit_posts can create a draft feed and set these values through XML-RPC. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, or to have feed files written outside the feed directory or with arbitrary extensions, when an administrator deletes, deactivates, or refreshes the planted feed. Deleting a file such as wp-config.php can lead to full site compromise.

## References

- https://wpsec.com/vuln/WPSEC-2026-3118/
- https://plugins.svn.wordpress.org/woo-product-feed-pro/tags/13.5.9/
- https://wordpress.org/plugins/woo-product-feed-pro/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3118/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.