Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce <= 13.5.8 - Authenticated (Contributor+) PHP Object Injection via Feed Meta
- ID
- WPSEC-2026-3119
- Plugin
- Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce (woo-product-feed-pro)
- Affected
- from 13.3.9 before 13.5.9
- Remediation
- Update to 13.5.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-502
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-13
- Attack surface
- Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Product Feed PRO for WooCommerce by AdTribes plugin for WordPress is vulnerable to PHP Object Injection via feed meta in all versions up to, and including, 13.5.8. This is due to two flaws. The adt_product_feed post type was registered with the default 'post' capabilities, so any user with edit_posts can create a draft feed and set its adt_* custom fields through XML-RPC. The usage-tracking check-in also passes the stored adt_attributes meta through maybe_unserialize() a second time, without restricting classes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP object, which is unserialized when the weekly usage check-in runs on sites where usage tracking is enabled. No known POP chain is present in the vulnerable software. If a POP chain is present through an additional plugin or theme on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
References
- https://wpsec.com/vuln/WPSEC-2026-3119/
- https://plugins.svn.wordpress.org/woo-product-feed-pro/tags/13.5.9/
- https://wordpress.org/plugins/woo-product-feed-pro/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS